Red Hat Security Advisory

RHSA-2026:6720

Red Hat Quay 3.12.16

Released 2026-04-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8

Fixes 10 records

TI-2026-04006 CVE-2026-4602 · GHSA-8qwj-4jxw-m8jw

Incorrect numeric conversion in jsrsasign

HIGH 77

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00499 Published 2026-03-23 Partial fix · 11.1.1 CWE-681

TI-2026-04002 CVE-2026-4598 · GHSA-8g7p-jf3g-gxcp

Infinite loop in jsrsasign

HIGH 77

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an at…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00556 Published 2026-03-23 Partial fix · 11.1.1 CWE-835

TI-2026-04004 CVE-2026-4600 · GHSA-wvqx-v3f6-w8rh

Improper signature verification in jsrsasign

HIGH 74

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verificati…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0036 Published 2026-03-23 Partial fix · 11.1.1 CWE-347

TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

HIGH 72

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-03-12 Partial fix · 2.12.0 CWE-345

TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

HIGH 72

pyasn1 is a generic ASN.1 library for Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00835 Published 2026-03-18 Partial fix · 0.6.3 CWE-674

TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0024 Published 2026-03-16 Partial fix · 1.6.9 CWE-354

TI-2026-04003 CVE-2026-4599 · GHSA-5jx8-q4cp-rhh6

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to…

MEDIUM 49

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00485 Published 2026-03-23 Partial fix · 11.1.1 CWE-1023

TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

MEDIUM 46

Immutable.js provides many Persistent Immutable data structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0099 Published 2026-03-06 Partial fix · 3.8.3, 4.3.7 +2 CWE-1321

TI-2026-04005 CVE-2026-4601 · GHSA-w8q8-93cx-6h7r

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic…

MEDIUM 42

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00305 Published 2026-03-23 Partial fix · 11.1.1 CWE-325

TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425