Red Hat Security Advisory

RHSA-2026:6912

Red Hat Quay 3.10.20

Released 2026-04-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8

Fixes 7 records

TI-2026-04006 CVE-2026-4602 · GHSA-8qwj-4jxw-m8jw

Incorrect numeric conversion in jsrsasign

HIGH 77

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00499 Published 2026-03-23 Partial fix · 11.1.1 CWE-681

TI-2026-04004 CVE-2026-4600 · GHSA-wvqx-v3f6-w8rh

Improper signature verification in jsrsasign

HIGH 74

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verificati…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0036 Published 2026-03-23 Partial fix · 11.1.1 CWE-347

TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

HIGH 72

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-03-12 Partial fix · 2.12.0 CWE-345

TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

HIGH 72

pyasn1 is a generic ASN.1 library for Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00835 Published 2026-03-18 Partial fix · 0.6.3 CWE-674

TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0024 Published 2026-03-16 Partial fix · 1.6.9 CWE-354

TI-2026-04003 CVE-2026-4599 · GHSA-5jx8-q4cp-rhh6

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to…

MEDIUM 49

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00485 Published 2026-03-23 Partial fix · 11.1.1 CWE-1023

TI-2026-04005 CVE-2026-4601 · GHSA-w8q8-93cx-6h7r

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic…

MEDIUM 42

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00305 Published 2026-03-23 Partial fix · 11.1.1 CWE-325