Read the docs
Red Hat Security Advisory

RHSA-2026:22840

Red Hat Quay 3.10.22

Released 2026-06-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 19 records

TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7

Server-side request forgery in axios

Priority HIGH 82

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183
TI-2026-04002 CVE-2026-4598 · GHSA-8g7p-jf3g-gxcp

Infinite loop in jsrsasign

Priority HIGH 77

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an at…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00556 Published 2026-03-23 Partial fix · 11.1.1 CWE-835
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Priority HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00403 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-113
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

Priority MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248
TI-2026-24809 CVE-2026-32280 · GHSA-m4pr-4j3g-9v7v

Unexpected work during chain building in crypto/x509

Priority MEDIUM 40

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00626 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-770
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm

Inefficient policy validation in crypto/x509

Priority LOW 39

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-295
TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Priority LOW 30

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00297 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-59