Vulnerability-Lookup

RHSA-2026:81110

Vulnerability from csaf_redhat - Published: 2026-10-12 13:18 - Updated: 2026-10-12 21:12

Summary

Red Hat Security Advisory: Red Hat Quay

Severity

Important

Notes

Topic: A new version of Red Hat Quay is now available.

Details: Red Hat Quay

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-15792

A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64	—	Vendor Fix fix Workaround

Known not affected 27 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x	—	Workaround

Threats

Impact Moderate

CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x	—	Vendor Fix fix Workaround

Known not affected 27 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x	—	Workaround

Threats

Impact Important

CVE-2026-18255

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-863 - Incorrect Authorization

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-44705

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-49477

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-49825

A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user's browser.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CWE-166 - Improper Handling of Missing Special Element

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-54058

A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-55379

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-55380

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59197

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59199

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library's image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59200

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the PdfParser.PdfStream.decode() function when processing a crafted FlateDecode PDF stream. By providing a specially designed PDF file, the attacker could cause the application to exhaust available memory, leading to a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59204

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59205

A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform's declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-59886

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-67214

A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-839 - Numeric Range Comparison Without Minimum Check

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-67314

A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-16221

Known not affected 27 products, the same list as for CVE-2026-16221

Threats

Impact Important

References

158 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:81110	self
https://access.redhat.com/security/cve/CVE-2026-15792	external
https://access.redhat.com/security/cve/CVE-2026-16221	external
https://access.redhat.com/security/cve/CVE-2026-18255	external
https://access.redhat.com/security/cve/CVE-2026-44705	external
https://access.redhat.com/security/cve/CVE-2026-49477	external
https://access.redhat.com/security/cve/CVE-2026-49825	external
https://access.redhat.com/security/cve/CVE-2026-54058	external
https://access.redhat.com/security/cve/CVE-2026-54770	external
https://access.redhat.com/security/cve/CVE-2026-55379	external
https://access.redhat.com/security/cve/CVE-2026-55380	external
https://access.redhat.com/security/cve/CVE-2026-59197	external
https://access.redhat.com/security/cve/CVE-2026-59199	external
https://access.redhat.com/security/cve/CVE-2026-59200	external
https://access.redhat.com/security/cve/CVE-2026-59204	external
https://access.redhat.com/security/cve/CVE-2026-59205	external
https://access.redhat.com/security/cve/CVE-2026-59886	external
https://access.redhat.com/security/cve/CVE-2026-67214	external
https://access.redhat.com/security/cve/CVE-2026-67313	external
https://access.redhat.com/security/cve/CVE-2026-67314	external
https://access.redhat.com/security/cve/CVE-2026-67320	external
https://access.redhat.com/security/cve/CVE-2026-67321	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-15792	self
https://bugzilla.redhat.com/show_bug.cgi?id=2503746	external
https://www.cve.org/CVERecord?id=CVE-2026-15792	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15792	external
https://github.com/moby/buildkit/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-16221	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502307	external
https://www.cve.org/CVERecord?id=CVE-2026-16221	external
https://nvd.nist.gov/vuln/detail/CVE-2026-16221	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-18255	self
https://bugzilla.redhat.com/show_bug.cgi?id=2508454	external
https://www.cve.org/CVERecord?id=CVE-2026-18255	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18255	external
https://access.redhat.com/security/cve/CVE-2026-44705	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487946	external
https://www.cve.org/CVERecord?id=CVE-2026-44705	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44705	external
https://github.com/raszi/node-tmp/security/adviso…	external
https://access.redhat.com/security/cve/CVE-2026-49477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500752	external
https://www.cve.org/CVERecord?id=CVE-2026-49477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49477	external
https://github.com/facelessuser/soupsieve/commit/…	external
https://github.com/facelessuser/soupsieve/release…	external
https://github.com/facelessuser/soupsieve/securit…	external
https://access.redhat.com/security/cve/CVE-2026-49825	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520368	external
https://www.cve.org/CVERecord?id=CVE-2026-49825	external
https://nvd.nist.gov/vuln/detail/CVE-2026-49825	external
https://github.com/fedora-python/lxml_html_clean/…	external
https://github.com/fedora-python/lxml_html_clean/…	external
https://github.com/fedora-python/lxml_html_clean/…	external
https://github.com/lxml/lxml/commit/5927a6d5e8518…	external
https://github.com/lxml/lxml/releases/tag/lxml-6.1.1	external
https://access.redhat.com/security/cve/CVE-2026-54058	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500057	external
https://www.cve.org/CVERecord?id=CVE-2026-54058	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54058	external
https://github.com/python-pillow/Pillow/commit/6a…	external
https://github.com/python-pillow/Pillow/pull/9719	external
https://github.com/python-pillow/Pillow/releases/…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-54770	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520616	external
https://www.cve.org/CVERecord?id=CVE-2026-54770	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54770	external
https://github.com/Pylons/webob/commit/ff89560643…	external
https://github.com/Pylons/webob/security/advisori…	external
https://github.com/Pylons/webob/tree/1.8.11	external
https://access.redhat.com/security/cve/CVE-2026-55379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497452	external
https://www.cve.org/CVERecord?id=CVE-2026-55379	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55379	external
https://github.com/python-pillow/Pillow/blob/main…	external
https://github.com/python-pillow/Pillow/commit/0a…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-55380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497455	external
https://www.cve.org/CVERecord?id=CVE-2026-55380	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55380	external
https://github.com/python-pillow/Pillow/commit/f3…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59197	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500043	external
https://www.cve.org/CVERecord?id=CVE-2026-59197	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59197	external
https://github.com/python-pillow/Pillow/commit/cc…	external
https://github.com/python-pillow/Pillow/pull/9695	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59199	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500061	external
https://www.cve.org/CVERecord?id=CVE-2026-59199	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59199	external
https://github.com/python-pillow/Pillow/commit/ce…	external
https://github.com/python-pillow/Pillow/pull/9703	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59200	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500060	external
https://www.cve.org/CVERecord?id=CVE-2026-59200	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59200	external
https://github.com/python-pillow/Pillow/commit/f7…	external
https://github.com/python-pillow/Pillow/pull/9718	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59204	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500022	external
https://www.cve.org/CVERecord?id=CVE-2026-59204	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59204	external
https://github.com/python-pillow/Pillow/commit/13…	external
https://github.com/python-pillow/Pillow/pull/9704	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59205	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500052	external
https://www.cve.org/CVERecord?id=CVE-2026-59205	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59205	external
https://github.com/python-pillow/Pillow/commit/a9…	external
https://github.com/python-pillow/Pillow/pull/9715	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500041	external
https://www.cve.org/CVERecord?id=CVE-2026-59886	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59886	external
https://github.com/pyasn1/pyasn1/commit/e60c691cb…	external
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	external
https://github.com/pyasn1/pyasn1/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-67214	self
https://bugzilla.redhat.com/show_bug.cgi?id=2508411	external
https://www.cve.org/CVERecord?id=CVE-2026-67214	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67214	external
https://github.com/ai/nanoid/commit/6ccc67bbaba71…	external
https://github.com/ai/nanoid/releases/tag/5.1.16	external
https://www.vulncheck.com/advisories/nanoid-befor…	external
https://access.redhat.com/security/cve/CVE-2026-67313	self
https://www.cve.org/CVERecord?id=CVE-2026-67313	external
https://access.redhat.com/security/cve/CVE-2026-67314	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510030	external
https://www.cve.org/CVERecord?id=CVE-2026-67314	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67314	external
https://github.com/axios/axios/security/advisorie…	external
https://www.vulncheck.com/advisories/axios-before…	external
https://access.redhat.com/security/cve/CVE-2026-67320	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509993	external
https://www.cve.org/CVERecord?id=CVE-2026-67320	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67320	external
https://github.com/axios/axios/commit/df53d7dd99b…	external
https://github.com/axios/axios/security/advisorie…	external
https://www.vulncheck.com/advisories/axios-before…	external
https://access.redhat.com/security/cve/CVE-2026-67321	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510011	external
https://www.cve.org/CVERecord?id=CVE-2026-67321	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67321	external
https://github.com/axios/axios/security/advisorie…	external
https://www.vulncheck.com/advisories/axios-before…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new version of Red Hat Quay is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Quay",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:81110",
        "url": "https://access.redhat.com/errata/RHSA-2026:81110"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15792",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15792"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18255",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18255"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44705",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44705"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49825",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54058",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54058"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54770",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55379",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55379"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55380",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55380"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59197",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59197"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59199",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59199"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59200",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59200"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59204",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59204"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59205",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59205"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59886",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67214",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67214"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81110.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay",
    "tracking": {
      "current_release_date": "2026-10-12T21:12:53+00:00",
      "generator": {
        "date": "2026-10-12T21:12:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:81110",
      "initial_release_date": "2026-10-12T13:18:49+00:00",
      "revision_history": [
        {
          "date": "2026-10-12T13:18:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-12T13:18:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-12T21:12:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.18",
                "product": {
                  "name": "Red Hat Quay 3.18",
                  "product_id": "Red Hat Quay 3.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-rhel9-operator@sha256%3Af50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-rhel9-operator\u0026tag=1791279106"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1791298531"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-rhel9-operator@sha256%3A339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-rhel9-operator\u0026tag=1791279118"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1791298533"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3Af5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1791305715"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1791266624"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3A4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1791279250"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9-operator@sha256%3A36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9-operator\u0026tag=1791305677"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3Ab241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1791306533"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1791265590"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-rhel9-operator@sha256%3A133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-rhel9-operator\u0026tag=1791279106"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-rhel9-operator@sha256%3Ae389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-rhel9-operator\u0026tag=1791279118"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3A49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1791305715"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1791266624"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3A663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1791279250"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9-operator@sha256%3A1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9-operator\u0026tag=1791305677"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1791265590"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-rhel9-operator@sha256%3A8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-rhel9-operator\u0026tag=1791279106"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-rhel9-operator@sha256%3A89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-rhel9-operator\u0026tag=1791279118"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3Aab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1791305715"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1791266624"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3Ae6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1791279250"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9-operator@sha256%3A27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9-operator\u0026tag=1791305677"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1791265590"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-rhel9-operator@sha256%3A152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-rhel9-operator\u0026tag=1791279106"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-rhel9-operator@sha256%3Ab9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-rhel9-operator\u0026tag=1791279118"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3Adf60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1791305715"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1791266624"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3A8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1791279250"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9-operator@sha256%3A9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9-operator\u0026tag=1791305677"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3Afbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1791265590"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64 as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x as a component of Red Hat Quay 3.18",
          "product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15792",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-07-21T17:01:51.555730+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503746"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "BuildKit is used by several Red Hat products to build container images. This issue allows a malicious BuildKit frontend or client to cause the BuildKit build process to crash. Exploiting this issue requires the ability to supply a build definition (for example, a Dockerfile specifying a custom #syntax frontend) to a BuildKit-based build; it does not allow remote code execution or exposure of data. The issue is fixed upstream in BuildKit version 0.31.2. Red Hat Hardened Images (Buildah, Podman, and Trivy) has already shipped the fixed version. Other affected Red Hat products are being assessed and will ship the fixed version of BuildKit in upcoming releases.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503746",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503746"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15792",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6",
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6"
        }
      ],
      "release_date": "2026-07-21T16:10:21.395000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Avoid building container images using BuildKit frontends from untrusted sources. A BuildKit frontend is typically specified using a \"# syntax\" directive at the top of a Dockerfile, or with the \"--frontend\" option to the \"buildctl build\" command. Only use frontend images that come from a trusted source.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request"
    },
    {
      "cve": "CVE-2026-16221",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-19T15:02:40.167601+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js\u0027s native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in fast-uri allows for a security policy bypass due to inconsistent URL parsing between fast-uri and Node.js\u0027s native WHATWG URL parser. Applications within Red Hat Hardened Images that rely on fast-uri for host-based policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, can be misled by specially crafted URLs. This could enable an attacker to redirect traffic to unintended internal or sensitive network destinations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"
        }
      ],
      "release_date": "2026-07-19T14:08:32.993000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency"
    },
    {
      "cve": "CVE-2026-18255",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-07-21T14:34:20+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quay: quay: Global read-only superuser can view robot account tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255"
        }
      ],
      "release_date": "2026-07-21T14:34:20+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "quay: quay: Global read-only superuser can view robot account tokens"
    },
    {
      "cve": "CVE-2026-44705",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-11T17:01:27.295887+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487946"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Applications that pass user-controlled data to the file or directory creation functions without input sanitization are vulnerable to this issue. This flaw allows files to be created in arbitrary locations with the privileges of the running process. Due to this reason, this vulnerability has been rated with an Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487946",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487946"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44705",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65",
          "url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"
        }
      ],
      "release_date": "2026-06-11T15:42:46.565000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    },
    {
      "cve": "CVE-2026-49825",
      "cwe": {
        "id": "CWE-166",
        "name": "Improper Handling of Missing Special Element"
      },
      "discovery_date": "2026-08-20T15:01:41.793678+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2",
          "url": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5",
          "url": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f",
          "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0",
          "url": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1",
          "url": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1"
        }
      ],
      "release_date": "2026-08-20T14:42:30.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href"
    },
    {
      "cve": "CVE-2026-54058",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-14T17:02:34.864708+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500057"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Pillow is vulnerable to an out-of-bounds read when processing a crafted uncompressed McIdas AREA image via the mmap raw codec. A remote attacker who can supply such an image to a service that loads it without user interaction may disclose adjacent process memory or trigger a denial of service. Fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500057",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500057"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54058",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",
          "url": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9719",
          "url": "https://github.com/python-pillow/Pillow/pull/9719"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"
        }
      ],
      "release_date": "2026-07-14T16:27:38.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image"
    },
    {
      "cve": "CVE-2026-54770",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2026-08-20T16:52:08.382509+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an open redirect vulnerability in the WebOb library. An unauthenticated attacker can craft a malicious URL that, when processed by applications utilizing WebOb for redirects, bypasses URL validation. This could lead to users being redirected to attacker-controlled sites, facilitating phishing attacks or the theft of authentication tokens, provided the user follows the redirect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/tree/1.8.11",
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "release_date": "2026-08-20T16:31:46.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft"
    },
    {
      "cve": "CVE-2026-55379",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-06T20:01:29.922515+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497452"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497452",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
          "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
        }
      ],
      "release_date": "2026-07-06T18:52:11.633000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
    },
    {
      "cve": "CVE-2026-55380",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-07-06T20:01:42.245051+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
          "url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
        }
      ],
      "release_date": "2026-07-06T18:50:14.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
    },
    {
      "cve": "CVE-2026-59197",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-14T17:01:29.487456+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500043"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Native heap out-of-bounds write",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Pillow\u0027s RankFilter API is vulnerable to a native heap out-of-bounds write when a caller supplies a very large odd filter size. Expansion runs before size validation and ImagingExpand uses unchecked signed integer arithmetic for output dimensions. A remote attacker who can drive RankFilter with attacker-controlled sizes may crash the process or corrupt heap memory. Fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500043",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500043"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59197",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",
          "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9695",
          "url": "https://github.com/python-pillow/Pillow/pull/9695"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
        }
      ],
      "release_date": "2026-07-14T16:25:23.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Native heap out-of-bounds write"
    },
    {
      "cve": "CVE-2026-59199",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-07-14T17:02:51.371888+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500061"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library\u0027s image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service. While the underlying issue is a heap out-of-bounds write, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500061",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500061"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59199",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",
          "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9703",
          "url": "https://github.com/python-pillow/Pillow/pull/9703"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
        }
      ],
      "release_date": "2026-07-14T15:42:15.071000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing"
    },
    {
      "cve": "CVE-2026-59200",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-14T17:02:45.929986+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500060"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the PdfParser.PdfStream.decode() function when processing a crafted FlateDecode PDF stream. By providing a specially designed PDF file, the attacker could cause the application to exhaust available memory, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of service via crafted PDF stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service via memory exhaustion. A small crafted PDF input can force unbounded decompression, but this does not lead to code execution or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500060",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500060"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59200",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09",
          "url": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9718",
          "url": "https://github.com/python-pillow/Pillow/pull/9718"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"
        }
      ],
      "release_date": "2026-07-14T16:09:05.091000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of service via crafted PDF stream"
    },
    {
      "cve": "CVE-2026-59204",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-07-14T16:02:11.802781+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500022"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service via excessive memory allocation. A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500022",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500022"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca",
          "url": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9704",
          "url": "https://github.com/python-pillow/Pillow/pull/9704"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"
        }
      ],
      "release_date": "2026-07-14T15:38:29.545000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer.\n\nFor services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image"
    },
    {
      "cve": "CVE-2026-59205",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-07-14T17:02:11.367224+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform\u0027s declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service. While the underlying issue is heap corruption via mode mismatch, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59205",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",
          "url": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9715",
          "url": "https://github.com/python-pillow/Pillow/pull/9715"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"
        }
      ],
      "release_date": "2026-07-14T15:48:39.962000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Most applications using Pillow\u0027s color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm.\n\nRHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API"
    },
    {
      "cve": "CVE-2026-59886",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T17:01:19.689422+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in pyasn1, rated as Important, could lead to a denial of service in Red Hat products that process untrusted ASN.1 data. A remote attacker could send a specially crafted BER, CER, or DER encoded REAL value with a large exponent, causing applications to consume excessive resources during decoding operations such as printing, logging, or arithmetic, thereby rendering the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59886",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886",
          "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r"
        }
      ],
      "release_date": "2026-07-14T16:38:29.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values"
    },
    {
      "cve": "CVE-2026-67214",
      "cwe": {
        "id": "CWE-839",
        "name": "Numeric Range Comparison Without Minimum Check"
      },
      "discovery_date": "2026-07-29T14:01:28.637584+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library\u0027s non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An input validation flaw in Nano ID\u0027s non-secure module (`nanoid/non-secure`) causes an infinite loop in the `customAlphabet` and `nanoid` functions when processed with a negative size parameter. Because the decrementing loop counter never meets its termination condition, an unauthenticated attacker who passes an unvalidated negative integer value can block the NodeJS event loop, resulting in a thread hang and complete Denial of Service (DoS) for the host application.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67214",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49",
          "url": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.16",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.16"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module",
          "url": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"
        }
      ],
      "release_date": "2026-07-29T13:32:02.265000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "category": "workaround",
          "details": "Sanitize all user-supplied integer inputs before passing them to `nanoid` or `customAlphabet` functions in the `nanoid/non-secure` module, ensuring the size parameter is strictly a non-negative integer.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions"
    },
    {
      "cve": "CVE-2026-67313",
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    },
    {
      "cve": "CVE-2026-67321",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:02:49.231124+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via object serialization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
          "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
        }
      ],
      "release_date": "2026-08-01T12:22:18.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T13:18:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
          "product_ids": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783_amd64",
            "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:fbe63262355afc7d1d44f86ef5b0a5dcedf244649567732e63c06addf1b62bff_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via object serialization bypass"
    }
  ]
}

CVE-2026-15792 (GCVE-0-2026-15792)

Vulnerability from cvelistv5 – Published: 2026-07-21 16:10 – Updated: 2026-07-21 17:01

Title

Possible panic when incorrect parameters sent from frontend

Summary

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 17:01 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

Docker CNA under the mitre root

CNA scorecard B 88/100 over 33 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/moby/buildkit/security/advisor…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
moby	BuildKit	Affected: 0 , < 0.31.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T17:01:19.161414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T17:01:55.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "MacOS",
            "Windows"
          ],
          "product": "BuildKit",
          "vendor": "moby",
          "versions": [
            {
              "lessThan": "0.31.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic."
            }
          ],
          "value": "A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T16:10:21.395Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Possible panic when incorrect parameters sent from frontend",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the #syntax line on your Dockerfile, or with --frontend flag when using buildctl build command."
            }
          ],
          "value": "Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the #syntax line on your Dockerfile, or with --frontend flag when using buildctl build command."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-15792",
    "datePublished": "2026-07-21T16:10:21.395Z",
    "dateReserved": "2026-07-14T19:31:00.046Z",
    "dateUpdated": "2026-07-21T17:01:55.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16221 (GCVE-0-2026-16221)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:08 – Updated: 2026-07-20 13:53

Title

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Summary

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:53 UTC

CWE

CWE-436 - Interpretation Conflict

Assigner

openjs CNA under the redhat root

CNA scorecard C 65/100 over 99 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/fastify/fast-uri/security/advi…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
fast-uri	fast-uri	Affected: 2.3.1 , < 2.4.3 (semver) Unaffected: 2.4.3 (semver) Affected: 3.0.0 , < 3.1.4 (semver) Unaffected: 3.1.4 (semver) Affected: 4.0.0 , < 4.1.1 (semver) Unaffected: 4.1.1 (semver)

Credits

rampage0010 mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:53:31.279563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:53:42.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/fast-uri",
          "product": "fast-uri",
          "vendor": "fast-uri",
          "versions": [
            {
              "lessThan": "2.4.3",
              "status": "affected",
              "version": "2.3.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.4.3",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.4",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.1.4",
              "versionType": "semver"
            },
            {
              "lessThan": "4.1.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.1.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rampage0010"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node\u0027s native WHATWG URL parser, used by fetch, undici, and Node\u0027s http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node\u0027s URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none."
            }
          ],
          "value": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node\u0027s native WHATWG URL parser, used by fetch, undici, and Node\u0027s http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node\u0027s URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:08:32.993Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-16221",
    "datePublished": "2026-07-19T14:08:32.993Z",
    "dateReserved": "2026-07-18T11:37:36.004Z",
    "dateUpdated": "2026-07-20T13:53:42.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18255 (GCVE-0-2026-18255)

Vulnerability from cvelistv5 – Published: 2026-07-29 16:34 – Updated: 2026-10-12 21:10

Title

Quay: quay: global read-only superuser can view robot account tokens

Summary

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-29 18:05 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

redhat CNA under the redhat root

CNA scorecard B 81/100 over 987 records in the last 180 days details

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:63307	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65514	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66084	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66523	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:69255	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:70267	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:74511	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:81110	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18255	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2508454	issue-trackingx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
Red Hat	Red Hat Quay 3.10	Unaffected: 1788561841 , < * (rpm) cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	Unaffected: 1788594376 , < * (rpm) cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.14	Unaffected: 1788593843 , < * (rpm) cpe:/a:redhat:quay:3.14::el8
Red Hat	Red Hat Quay 3.15	Unaffected: 1788191755 , < * (rpm) cpe:/a:redhat:quay:3.15::el8
Red Hat	Red Hat Quay 3.16	Unaffected: 1789563753 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Quay 3.17	Unaffected: 1790690298 , < * (rpm) cpe:/a:redhat:quay:3.17::el9
Red Hat	Red Hat Quay 3.18	Unaffected: 1791265590 , < * (rpm) cpe:/a:redhat:quay:3.18::el9
Red Hat	Red Hat Quay 3.9	Unaffected: 1788595574 , < * (rpm) cpe:/a:redhat:quay:3.9::el8

Date Public

2026-07-21 14:34

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T18:05:45.459458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T18:05:53.353Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.10::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3.10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788561841",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.12::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788594376",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788593843",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788191755",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel9",
          "product": "Red Hat Quay 3.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1789563753",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel9",
          "product": "Red Hat Quay 3.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790690298",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel9",
          "product": "Red Hat Quay 3.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1791265590",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3.9::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3.9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788595574",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-07-21T14:34:20.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T21:10:04.837Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:63307",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:63307"
        },
        {
          "name": "RHSA-2026:65514",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:65514"
        },
        {
          "name": "RHSA-2026:66084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:66084"
        },
        {
          "name": "RHSA-2026:66523",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:66523"
        },
        {
          "name": "RHSA-2026:69255",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:69255"
        },
        {
          "name": "RHSA-2026:70267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:70267"
        },
        {
          "name": "RHSA-2026:74511",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "name": "RHSA-2026:81110",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:81110"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18255"
        },
        {
          "name": "RHBZ#2508454",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508454"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-21T14:34:20.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T14:34:20.000Z",
          "value": "Made public."
        }
      ],
      "title": "Quay: quay: global read-only superuser can view robot account tokens",
      "workarounds": [
        {
          "lang": "en",
          "value": "Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-863: Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18255",
    "datePublished": "2026-07-29T16:34:44.442Z",
    "dateReserved": "2026-07-29T16:19:25.998Z",
    "dateUpdated": "2026-10-12T21:10:04.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44705 (GCVE-0-2026-44705)

Vulnerability from cvelistv5 – Published: 2026-06-11 15:42 – Updated: 2026-06-13 02:20

Title

tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

Summary

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-13 02:18 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/raszi/node-tmp/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
raszi	node-tmp	Affected: < 0.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44705",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-13T02:18:03.998417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-13T02:20:44.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-tmp",
          "vendor": "raszi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp\u0027s file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T15:42:46.565Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"
        }
      ],
      "source": {
        "advisory": "GHSA-ph9p-34f9-6g65",
        "discovery": "UNKNOWN"
      },
      "title": "tmp: Path Traversal via unsanitized prefix/postfix enables directory escape"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44705",
    "datePublished": "2026-06-11T15:42:46.565Z",
    "dateReserved": "2026-05-07T17:07:09.317Z",
    "dateUpdated": "2026-06-13T02:20:44.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49477 (GCVE-0-2026-49477)

Vulnerability from cvelistv5 – Published: 2026-07-14 20:51 – Updated: 2026-07-21 14:49

Title

Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser

Summary

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:49 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/facelessuser/soupsieve/securit…	x_refsource_CONFIRM
https://github.com/facelessuser/soupsieve/commit/…	x_refsource_MISC
https://github.com/facelessuser/soupsieve/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
facelessuser	soupsieve	Affected: < 2.8.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49477",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:49:25.096784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:49:40.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "soupsieve",
          "vendor": "facelessuser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T20:51:29.369Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        },
        {
          "name": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "name": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        }
      ],
      "source": {
        "advisory": "GHSA-836r-79rf-4m37",
        "discovery": "UNKNOWN"
      },
      "title": "Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49477",
    "datePublished": "2026-07-14T20:51:29.369Z",
    "dateReserved": "2026-05-30T04:17:43.095Z",
    "dateUpdated": "2026-07-21T14:49:40.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49825 (GCVE-0-2026-49825)

Vulnerability from cvelistv5 – Published: 2026-08-20 14:42 – Updated: 2026-08-21 16:41

Title

lxml: javascript: URL bypass in Cleaner via xlink:href

Summary

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 16:41 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/fedora-python/lxml_html_clean/…	x_refsource_CONFIRM
https://github.com/fedora-python/lxml_html_clean/…	x_refsource_MISC
https://github.com/lxml/lxml/commit/5927a6d5e8518…	x_refsource_MISC
https://github.com/fedora-python/lxml_html_clean/…	x_refsource_MISC
https://github.com/lxml/lxml/releases/tag/lxml-6.1.1	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
lxml	lxml	Affected: < 6.1.1
fedora-python	lxml_html_clean	Affected: < 0.4.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T16:41:32.043801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T16:41:54.849Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lxml",
          "vendor": "lxml",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.1"
            }
          ]
        },
        {
          "product": "lxml_html_clean",
          "vendor": "fedora-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T14:42:30.748Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
        },
        {
          "name": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
        },
        {
          "name": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0"
        },
        {
          "name": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5"
        },
        {
          "name": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4jhm-jv67-739f",
        "discovery": "UNKNOWN"
      },
      "title": "lxml: javascript: URL bypass in Cleaner via xlink:href"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49825",
    "datePublished": "2026-08-20T14:42:30.748Z",
    "dateReserved": "2026-06-01T18:50:36.055Z",
    "dateUpdated": "2026-08-21T16:41:54.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54058 (GCVE-0-2026-54058)

Vulnerability from cvelistv5 – Published: 2026-07-14 16:27 – Updated: 2026-07-14 17:54

Title

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 17:53 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/python-pillow/Pillow/security/…	x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/9719	x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/6a…	x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
python-pillow	Pillow	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54058",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T17:53:55.907731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T17:54:25.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:27:38.050Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/pull/9719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/pull/9719"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-62p4-gmf7-7g93",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow\u0027s mmap path (McIdas AREA files)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54058",
    "datePublished": "2026-07-14T16:27:38.050Z",
    "dateReserved": "2026-06-11T18:24:35.096Z",
    "dateUpdated": "2026-07-14T17:54:25.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54770 (GCVE-0-2026-54770)

Vulnerability from cvelistv5 – Published: 2026-08-20 16:31 – Updated: 2026-08-25 15:04

Title

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:03 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Pylons/webob/security/advisori…	x_refsource_CONFIRM
https://github.com/Pylons/webob/commit/ff89560643…	x_refsource_MISC
https://github.com/Pylons/webob/tree/1.8.11	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Pylons	webob	Affected: < 1.8.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54770",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:03:54.011941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:04:18.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "webob",
          "vendor": "Pylons",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application\u0027s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:31:46.791Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "name": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "name": "https://github.com/Pylons/webob/tree/1.8.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "source": {
        "advisory": "GHSA-6hx8-3wjj-gr8g",
        "discovery": "UNKNOWN"
      },
      "title": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54770",
    "datePublished": "2026-08-20T16:31:46.791Z",
    "dateReserved": "2026-06-15T23:23:57.713Z",
    "dateUpdated": "2026-08-25T15:04:18.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55379 (GCVE-0-2026-55379)

Vulnerability from cvelistv5 – Published: 2026-07-06 18:52 – Updated: 2026-07-06 19:17

Title

Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 19:16 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/python-pillow/Pillow/security/…	x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/0a…	x_refsource_MISC
https://github.com/python-pillow/Pillow/blob/main…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
python-pillow	Pillow	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55379",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T19:16:56.631649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T19:17:03.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0027s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T18:52:11.633Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        }
      ],
      "source": {
        "advisory": "GHSA-45hq-cxwh-f6vc",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` \u2014 bomb protection bypass via font loading"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55379",
    "datePublished": "2026-07-06T18:52:11.633Z",
    "dateReserved": "2026-06-16T18:57:40.181Z",
    "dateUpdated": "2026-07-06T19:17:03.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55380 (GCVE-0-2026-55380)

Vulnerability from cvelistv5 – Published: 2026-07-06 18:50 – Updated: 2026-07-06 19:23

Title

Pillow GdImageFile decompression bomb protection bypass

Summary

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 19:23 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7625 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/python-pillow/Pillow/security/…	x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/f3…	x_refsource_MISC
https://github.com/python-pillow/Pillow/blob/main…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
python-pillow	Pillow	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55380",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T19:23:03.405538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T19:23:30.046Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T18:51:08.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        }
      ],
      "source": {
        "advisory": "GHSA-phj9-mv4w-65pm",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow GdImageFile decompression bomb protection bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55380",
    "datePublished": "2026-07-06T18:50:14.789Z",
    "dateReserved": "2026-06-16T18:57:40.182Z",
    "dateUpdated": "2026-07-06T19:23:30.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:81110

CVE-2026-15792 (GCVE-0-2026-15792)

CVE-2026-16221 (GCVE-0-2026-16221)

CVE-2026-18255 (GCVE-0-2026-18255)

CVE-2026-44705 (GCVE-0-2026-44705)

CVE-2026-49477 (GCVE-0-2026-49477)

CVE-2026-49825 (GCVE-0-2026-49825)

CVE-2026-54058 (GCVE-0-2026-54058)

CVE-2026-54770 (GCVE-0-2026-54770)

CVE-2026-55379 (GCVE-0-2026-55379)

CVE-2026-55380 (GCVE-0-2026-55380)

Tags

Sightings

Nomenclature

Related by attack behaviour