RHSA-2026:41031HighCVSS 8.8

Red Hat Security Advisory: Red Hat Quay 3.10.24

Published
July 16, 2026
Last Modified
September 19, 2026

🔗 CVE IDs covered (23)

CVE-2026-44990 →CVE-2026-46597 →CVE-2026-39821 →CVE-2026-39831 →CVE-2026-39832 →CVE-2026-44487 →CVE-2026-32591 →CVE-2026-39828 →CVE-2026-39829 →CVE-2026-42151 →CVE-2026-42154 →CVE-2026-44488 →CVE-2026-44494 →CVE-2026-44495 →CVE-2026-12143 →CVE-2026-39820 →CVE-2026-39830 →CVE-2026-39835 →CVE-2026-42499 →CVE-2026-44486 →CVE-2026-44492 →CVE-2026-45822 →CVE-2026-42508 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-32591 — mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass CVE-2026-45822 — decode-uri-component: decode-uri-component: Denial of Service via crafted input CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

🎯 Affected products23

  • Red Hat Quay 3.10
  • registry.redhat.io/quay/clair-rhel8@sha256:2b0948a125eb22fdbcebdd668049aaac225079a75583ddf06e4e49182f377a83_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/clair-rhel8@sha256:91bddb7c09c65a8e9f1fc3955494962a5e45ba574fa2d3259b10a2f30a876d46_s390x as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/clair-rhel8@sha256:b1443598f34b3c99280742fd8be1144163a7c1ce45da4b4b40b31ec6b3af7156_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:cef838877d9f2a6035acaee9c03cf50c2e2db5052340394df595123137910a93_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a8934c1370a6f732a01f1a7fc24dd15acbca34920417f4527c836f120134b8b0_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bdcab3a8ad272869ef352e7e2c27d6ddbf082e3f54d757dbacb82e0a7e27b954_s390x as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bf85112b1a8131678225b7ebdde35eb830355cb36db2fd66439d4657f80883d6_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:a2604092734d5e480a5b47284d72004b93ef03a6735626e219c4da09477a4e6b_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:149c9092dc8353dd81ef346954c88062eeb64ec8b42c77467dc9ced80e322823_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:79e83b8cb01e73be55a565276b66a26f9d7864d242c0b484e95b31da51c12c9e_s390x as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:ae488a9521ce2267a04605ee4a78f7af8d2a452d7c90d53082ddec1546ff5693_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:de47c8f5fedac6402e34eea1d214a3bb2b9509df89ad8ae1593b91816eec082c_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9888e7c2ee198944d6bd1c83904d017e11b1aa99c57fd34fa9acb9ce61590136_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:a7641c7d809bb7715b33b0d17b278e51f4056b3859e07477ce885f82da0d17b1_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c0f8fc0557259cef23bd02702e3d8074b8fe2e25595f989091ffcccb934701ba_s390x as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-operator-bundle@sha256:23063c6e5051de1af14298ae2dcdb98831389ce9580474a43dbc8464cc5693c1_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:416d1cde3fb7a8a569bf2426644d1236275755a4e21a5be19733bf8edf3f6ba4_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:41caaea5f417d59e7041e9a9949ba9601d17ee846e74bb7e0e49672bdeb78dce_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:8de5c45c3856a9eb5cfc1ea77816bf417cfe612f55167e80526b97cdcea3a358_s390x as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-rhel8@sha256:026e6519823ab3eb33c7f4d0facabca919405db20205bc87a17e2ca346938a1f_amd64 as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-rhel8@sha256:a110717f6fafa6978daddf5521e0b380511230b522691223fd8dd55033f547cf_ppc64le as a component of Red Hat Quay 3.10
  • registry.redhat.io/quay/quay-rhel8@sha256:c644dd914127126a7408676c8b3f2915d8fc842c4e87e714b6207c4af3b9032d_s390x as a component of Red Hat Quay 3.10

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Validate and limit the length of any user-controlled input before passing it to decode-uri-component's decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. '%ab' sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.

🔗 References (26)