RHSA-2026:21017HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.14.8

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (25)

CVE-2026-42041 →CVE-2026-2377 →CVE-2026-32280 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-27459 →CVE-2026-32286 →CVE-2026-32589 →CVE-2026-39892 →CVE-2026-42033 →CVE-2025-61726 →CVE-2025-62718 →CVE-2026-4427 · pendingCVE-2026-25679 →CVE-2026-32282 →CVE-2026-33894 →CVE-2026-34986 →CVE-2026-40895 →CVE-2026-29074 →CVE-2026-32281 →CVE-2026-32590 →CVE-2026-33186 →CVE-2026-40192 →CVE-2026-42035 →CVE-2026-42039 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-2377 — mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality CVE-2026-4427 — github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-32589 — mirror-registry: quay: insecure direct object reference in BlobUpload CVE-2026-32590 — mirror-registry: remote code execution using pickle deserialization CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39892 — cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products28

  • Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:4dcd3b60f93e03d7d59e7dedc2ffcaa835de53ce672a179527f26ffe295473d2_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:7a0ec7eb2f7e1cd78834a108c84edb7f3a9f769209ba98b8bb0d1f7d66344e72_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:c36f983f25aad87857f89920f0878fb081f9c55d471e98fa25a3af0507da4b42_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:c82534a20a7a5e2ecd49ac6307df13ede380c8b3d7ca4c6978aed1efab9c6ae4_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:36377e0f89e28bb05dd45c424ac336b2884e91267a118763ddd9a1e8d8f75295_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:087c088a5f5da9a54608fd93bbc47654b7c24661dfcdf3b64d04d496924a5e4b_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:0e7f72c6427b9c941a765470683c3cfe81644bd0337b88c5f3d9021978aa38de_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:496e288875b50bb6f5ff1f92cd95a8df52ee02e97178e4134fcc3fc0b829f3b1_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bc8584dbad964920db04fb5fa27044cb0219f7d736da16abe5deec2fb3d7b1a8_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1fa815f5c0f997f55ca2db83575360f084d0ead955e62adcb7b4f0b53b1a01c7_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:532d123f74a39a92346daf91d69f2eebc97d48d49cf89b21ec4114824cb23b2d_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b83c36737a574a3454d1be87b9bb7a513eab7b5071c662fde05e791ec2596ee2_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e76507eecc44ee17c66566769ff427c561df85db700c2b16ead0ecd894f40b9f_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:052bf6483aa0e3cfae7cc28822bb05b7ebf1c2dd2019bae53874db19a7ced51f_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:0f209a6799f9eb6987d9479fc6631d3f6dabdf89faa0059c9c62010f4f46e2ba_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:eade47dd4e39ed346f9ea867a90e07fc70ff2ff4a6cce4a21ac77f88e9abad10_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:fac5b4a10d565051251ec328df69026458ede4dadc48b401dcb923979bf96b88_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9e026e4b86da6a0719b0bf6973d465cd542ead1715afb516e5e37ae8d9057964_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-bundle@sha256:a620b5e2749ad150d7ee07bd240f29a69ad2593a522869bd334441e9fb346e0e_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:6753b3d04a0cbf3ae35f8141df96505f099a39645ae3e68ae0b417ac572be64e_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:85c3bbf75379da98fbffe5ea1c53893a11ce42939d68687f16a0b687a9ba4b33_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:9fc318dd2650e6f3b68084e2f155a5485395026cba186018f6a2d5e70284bb6a_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:db535f8a5dea4124ee8140a48362d0a631cc19158a3944f0059219a5c7b44e3e_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:4ae7d2d72a2370bd5401f570e21386bc9a6df0b145030060c922fcf754c7839b_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:9f5d146fc72a09d9067705a35274a251708cebc4c6a7e50615bdbce3e128c097_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:a46c3fd8bb72616f07d2fb47eae9b060ea6c5135ec365d7ddc0dc18054da0b1b_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:fca718bcd95971e571d13f9139e2f40c2daeca9605c669d73ed3055d9e3a53e2_ppc64le as a component of Red Hat Quay 3.14

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11458 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (28)