Red Hat Security Advisory

RHSA-2026:0518

Red Hat Quay 3.16.1

Released 2026-01-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9

Fixes 3 records

TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27

node-forge ASN.1 Unbounded Recursion

MEDIUM 44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00446 Published 2025-11-26 Partial fix · 1.3.2 CWE-674

TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…

MEDIUM 44

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0058 Published 2025-11-25 Partial fix · 1.3.2 CWE-436

TI-2025-36934 CVE-2025-59375 · GHSA-vjqp-pjp6-xcxx

Resource allocation without limits in libexpat

LOW 36

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0138 Published 2025-09-15 Partial fix · 2.7.2 CWE-770