Red Hat Security AdvisoryRHSA-2026:1730
Red Hat Quay 3.12.13
Released 2026-02-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
Fixes 12 records
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03181 · Published 2024-12-11 · Partial fix · 0.31.0 CWE-285
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.02922 · Published 2026-01-07 · Partial fix · 2.6.3 CWE-409
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-770
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01127 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-409
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00226 · Published 2025-12-04 · Partial fix · 1.8.3 CWE-405
Priority LOW 38
auth0/node-jws is a JSON Web Signature implementation for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00231 · Published 2025-12-04 · Partial fix · 3.2.3, 4.0.1 CWE-347
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.
CVSS 4.0HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00801 · Published 2025-11-06 · Partial fix · 1.2.8, 1.13.0 +2 CWE-363
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
THREATIST.IORead the docs