RHSA-2026:77656

Vulnerability from csaf_redhat - Published: 2026-10-07 15:14 - Updated: 2026-10-08 05:53
Summary
Red Hat Security Advisory: Red Hat Quay 3.9.27
Severity
Important
Notes
Topic: Red Hat Quay 3.9.27 is now available with bug fixes.
Details: Quay 3.9.27
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x —
Workaround
Threats
Impact Important
CVE-2026-49825

A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user's browser.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-166 - Improper Handling of Missing Special Element
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.

7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-59879

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Moderate
CVE-2026-77403

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. A malicious or compromised AMQP broker can exploit this by advertising an extremely small frame size during connection negotiation. This can lead to excessive fragmentation of client publications, consuming significant CPU resources and potentially causing a Denial of Service (DoS) by stalling the client or its host.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-839 - Numeric Range Comparison Without Minimum Check
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Moderate
CVE-2026-77404

A flaw was found in RabbitMQ amqp091-go. The URI.String function in uri.go concatenates TLS asset path values directly into an AMQPS query string without proper encoding. If an application processes a TLS asset path containing special characters like ampersand or equals delimiters, these can be misinterpreted during URI re-parsing. This vulnerability could allow an attacker to overwrite connection options, potentially corrupting the connection configuration or selecting unintended local cryptographic assets, leading to a compromise of the TLS connection.

8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-77406

A flaw was found in RabbitMQ amqp091-go. The `Channel.Qos` function in `channel.go` incorrectly handles negative integer values for `prefetchCount` and `prefetchSize`, casting them to large unsigned integers. This allows an application that processes untrusted Quality of Service (QoS) configuration to request extremely high message prefetch limits. Consequently, a message broker can deliver a large volume of queued messages, leading to client memory exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-77409

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. When the client synchronously sends events to application-provided channels, an unbuffered or full listener channel can cause the client's reader to block. This blockage prevents the processing of critical messages and heartbeats, leading to connection stalls, deadlocks, and disconnections. This vulnerability can result in a Denial of Service (DoS) for applications using the affected component.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-77410

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send an extreme declared message body size to a client. This causes the client to attempt an excessively large memory allocation without proper size capping, leading to memory exhaustion and termination of the client process. This vulnerability results in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-77412

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send a specially crafted AMQP (Advanced Message Queuing Protocol) message with a malformed field length. This can cause an integer overflow, leading to a runtime panic in the client process. Consequently, the client process terminates, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-79921

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-82417

A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
CVE-2026-87776

A flaw was found in the `compression` Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 3 products, the same list as for CVE-2026-17106
Known not affected 19 products, the same list as for CVE-2026-17106
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:77656 self
https://access.redhat.com/security/cve/CVE-2026-17106 external
https://access.redhat.com/security/cve/CVE-2026-49825 external
https://access.redhat.com/security/cve/CVE-2026-54770 external
https://access.redhat.com/security/cve/CVE-2026-59879 external
https://access.redhat.com/security/cve/CVE-2026-77403 external
https://access.redhat.com/security/cve/CVE-2026-77404 external
https://access.redhat.com/security/cve/CVE-2026-77406 external
https://access.redhat.com/security/cve/CVE-2026-77409 external
https://access.redhat.com/security/cve/CVE-2026-77410 external
https://access.redhat.com/security/cve/CVE-2026-77412 external
https://access.redhat.com/security/cve/CVE-2026-79921 external
https://access.redhat.com/security/cve/CVE-2026-82417 external
https://access.redhat.com/security/cve/CVE-2026-84292 external
https://access.redhat.com/security/cve/CVE-2026-84394 external
https://access.redhat.com/security/cve/CVE-2026-87776 external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-17106 self
https://bugzilla.redhat.com/show_bug.cgi?id=2518147 external
https://www.cve.org/CVERecord?id=CVE-2026-17106 external
https://nvd.nist.gov/vuln/detail/CVE-2026-17106 external
https://docs.docker.com/desktop/release-notes/#4860 external
https://docs.docker.com/engine/release-notes/29/#2970 external
https://github.com/docker/cli/releases/tag/v29.7.0 external
https://github.com/docker/compose/releases/tag/v5.4.0 external
https://github.com/docker/sbx-releases/releases/t… external
https://github.com/moby/go-archive/releases/tag/v0.3.0 external
https://github.com/moby/go-archive/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-49825 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520368 external
https://www.cve.org/CVERecord?id=CVE-2026-49825 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49825 external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/lxml/lxml/commit/5927a6d5e8518… external
https://github.com/lxml/lxml/releases/tag/lxml-6.1.1 external
https://access.redhat.com/security/cve/CVE-2026-54770 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520616 external
https://www.cve.org/CVERecord?id=CVE-2026-54770 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54770 external
https://github.com/Pylons/webob/commit/ff89560643… external
https://github.com/Pylons/webob/security/advisori… external
https://github.com/Pylons/webob/tree/1.8.11 external
https://access.redhat.com/security/cve/CVE-2026-59879 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498158 external
https://www.cve.org/CVERecord?id=CVE-2026-59879 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59879 external
https://github.com/immutable-js/immutable-js/comm… external
https://github.com/immutable-js/immutable-js/comm… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/secu… external
https://access.redhat.com/security/cve/CVE-2026-77403 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535498 external
https://www.cve.org/CVERecord?id=CVE-2026-77403 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77403 external
https://github.com/rabbitmq/amqp091-go/commit/2e0… external
https://github.com/rabbitmq/amqp091-go/pull/353 external
https://github.com/rabbitmq/amqp091-go/releases/t… external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-77404 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535489 external
https://www.cve.org/CVERecord?id=CVE-2026-77404 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77404 external
https://github.com/rabbitmq/amqp091-go/commit/743… external
https://github.com/rabbitmq/amqp091-go/pull/352 external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-77406 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535493 external
https://www.cve.org/CVERecord?id=CVE-2026-77406 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77406 external
https://github.com/rabbitmq/amqp091-go/commit/3b8… external
https://github.com/rabbitmq/amqp091-go/pull/351 external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-77409 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535494 external
https://www.cve.org/CVERecord?id=CVE-2026-77409 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77409 external
https://github.com/rabbitmq/amqp091-go/commit/5b0… external
https://github.com/rabbitmq/amqp091-go/pull/349 external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-77410 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535500 external
https://www.cve.org/CVERecord?id=CVE-2026-77410 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77410 external
https://github.com/rabbitmq/amqp091-go/commit/91b… external
https://github.com/rabbitmq/amqp091-go/pull/346 external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-77412 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535499 external
https://www.cve.org/CVERecord?id=CVE-2026-77412 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77412 external
https://github.com/rabbitmq/amqp091-go/commit/669… external
https://github.com/rabbitmq/amqp091-go/pull/344 external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-79921 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524713 external
https://www.cve.org/CVERecord?id=CVE-2026-79921 external
https://nvd.nist.gov/vuln/detail/CVE-2026-79921 external
https://github.com/rabbitmq/amqp091-go/commit/6be… external
https://github.com/rabbitmq/amqp091-go/security/a… external
https://access.redhat.com/security/cve/CVE-2026-82417 self
https://bugzilla.redhat.com/show_bug.cgi?id=2525936 external
https://www.cve.org/CVERecord?id=CVE-2026-82417 external
https://nvd.nist.gov/vuln/detail/CVE-2026-82417 external
https://github.com/ljharb/qs/commit/e83d321ffafb3… external
https://github.com/ljharb/qs/security/advisories/… external
https://access.redhat.com/security/cve/CVE-2026-84292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527747 external
https://www.cve.org/CVERecord?id=CVE-2026-84292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84292 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-84394 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527756 external
https://www.cve.org/CVERecord?id=CVE-2026-84394 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84394 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-87776 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531852 external
https://www.cve.org/CVERecord?id=CVE-2026-87776 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87776 external
https://github.com/expressjs/compression/security… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.9.27 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.9.27",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:77656",
        "url": "https://access.redhat.com/errata/RHSA-2026:77656"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-17106",
        "url": "https://access.redhat.com/security/cve/CVE-2026-17106"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49825",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54770",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59879",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59879"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77403",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77403"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77404",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77404"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77406",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77406"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77409",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77409"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77410",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77410"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77412",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77412"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79921",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82417",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82417"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87776",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87776"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77656.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.9.27",
    "tracking": {
      "current_release_date": "2026-10-08T05:53:17+00:00",
      "generator": {
        "date": "2026-10-08T05:53:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:77656",
      "initial_release_date": "2026-10-07T15:14:50+00:00",
      "revision_history": [
        {
          "date": "2026-10-07T15:14:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-07T15:14:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-08T05:53:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.9",
                "product": {
                  "name": "Red Hat Quay 3.9",
                  "product_id": "Red Hat Quay 3.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.9::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3Ab587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1790401178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1790399932"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1790400430"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Aa95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1790399899"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Acb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1790400248"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1790400755"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3Abc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1790697042"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3Ad8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1790903947"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1790399891"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Af33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1790808443"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ae46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1790399932"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1790399899"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1790400755"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1790697042"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1790399891"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Abf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1790808443"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1790399932"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1790399899"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1790400755"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3Afedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1790697042"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1790399891"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Afb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1790808443"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-17106",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-08-18T18:51:06.836464+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important severity vulnerability in `moby/go-archive` allows for arbitrary file writes during tar extraction. An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-17106",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "https://docs.docker.com/desktop/release-notes/#4860",
          "url": "https://docs.docker.com/desktop/release-notes/#4860"
        },
        {
          "category": "external",
          "summary": "https://docs.docker.com/engine/release-notes/29/#2970",
          "url": "https://docs.docker.com/engine/release-notes/29/#2970"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/cli/releases/tag/v29.7.0",
          "url": "https://github.com/docker/cli/releases/tag/v29.7.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/compose/releases/tag/v5.4.0",
          "url": "https://github.com/docker/compose/releases/tag/v5.4.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0",
          "url": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/go-archive/releases/tag/v0.3.0",
          "url": "https://github.com/moby/go-archive/releases/tag/v0.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h",
          "url": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h"
        }
      ],
      "release_date": "2026-08-18T18:35:13.465000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction"
    },
    {
      "cve": "CVE-2026-49825",
      "cwe": {
        "id": "CWE-166",
        "name": "Improper Handling of Missing Special Element"
      },
      "discovery_date": "2026-08-20T15:01:41.793678+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2",
          "url": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5",
          "url": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f",
          "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0",
          "url": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1",
          "url": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1"
        }
      ],
      "release_date": "2026-08-20T14:42:30.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href"
    },
    {
      "cve": "CVE-2026-54770",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2026-08-20T16:52:08.382509+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an open redirect vulnerability in the WebOb library. An unauthenticated attacker can craft a malicious URL that, when processed by applications utilizing WebOb for redirects, bypasses URL validation. This could lead to users being redirected to attacker-controlled sites, facilitating phishing attacks or the theft of authentication tokens, provided the user follows the redirect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/tree/1.8.11",
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "release_date": "2026-08-20T16:31:46.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft"
    },
    {
      "cve": "CVE-2026-59879",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-07-08T17:02:16.432203+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498158"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact denial of service vulnerability in Immutable.js affects Red Hat products that process untrusted input through List operations. An attacker can trigger an infinite loop or unbounded memory allocation by providing specially crafted large index values, leading to a service disruption. Additionally, silent data corruption may occur due to integer wrapping.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498158",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498158"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59879",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59879",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59879"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
          "url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
          "url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
          "url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735"
        }
      ],
      "release_date": "2026-07-08T15:47:24.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations"
    },
    {
      "cve": "CVE-2026-77403",
      "cwe": {
        "id": "CWE-839",
        "name": "Numeric Range Comparison Without Minimum Check"
      },
      "discovery_date": "2026-09-16T14:53:45.086464+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535498"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. A malicious or compromised AMQP broker can exploit this by advertising an extremely small frame size during connection negotiation. This can lead to excessive fragmentation of client publications, consuming significant CPU resources and potentially causing a Denial of Service (DoS) by stalling the client or its host.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535498",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535498"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77403"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/353",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/353"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2"
        }
      ],
      "release_date": "2026-09-16T14:36:19.270000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that applications using the RabbitMQ amqp091-go client only connect to trusted AMQP brokers. Restrict network access for clients to only communicate with known, secure broker instances. This reduces the risk of a malicious or compromised broker exploiting the client\u0027s vulnerability during frame size negotiation.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation"
    },
    {
      "cve": "CVE-2026-77404",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-16T14:51:56.561147+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535489"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go. The URI.String function in uri.go concatenates TLS asset path values directly into an AMQPS query string without proper encoding. If an application processes a TLS asset path containing special characters like ampersand or equals delimiters, these can be misinterpreted during URI re-parsing. This vulnerability could allow an attacker to overwrite connection options, potentially corrupting the connection configuration or selecting unintended local cryptographic assets, leading to a compromise of the TLS connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact because applications in Red Hat products that use amqp091-go and accept attacker-controlled TLS asset paths can be induced to reparse a crafted AMQPS URI. A local attacker with partial control of a certificate, key, CA, or server-name path or related environment setting can inject query parameters and alter connection configuration, potentially selecting unintended local TLS material or causing connection failures.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77404"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535489",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535489"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77404",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77404"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77404",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77404"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/743d488e46955fe7ffc55506fe2c401d01216783",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/743d488e46955fe7ffc55506fe2c401d01216783"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/352",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/352"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-465g-fh3v-9jw4",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-465g-fh3v-9jw4"
        }
      ],
      "release_date": "2026-09-16T14:40:49.895000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Avoid accepting untrusted values for TLS certificate, key, CA, or server-name paths. Restrict write access to directories and environment settings used to configure those paths, and upgrade applications using amqp091-go to version 1.13.0 or later when available.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection"
    },
    {
      "cve": "CVE-2026-77406",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-09-16T14:52:23.520218+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535493"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go. The `Channel.Qos` function in `channel.go` incorrectly handles negative integer values for `prefetchCount` and `prefetchSize`, casting them to large unsigned integers. This allows an application that processes untrusted Quality of Service (QoS) configuration to request extremely high message prefetch limits. Consequently, a message broker can deliver a large volume of queued messages, leading to client memory exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact because applications using amqp091-go can be disrupted if untrusted QoS configuration supplies negative prefetch values. Those values can be converted to extremely large message limits, allowing excessive message delivery and memory exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77406"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535493",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535493"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77406",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77406"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77406",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77406"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/351",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/351"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33"
        }
      ],
      "release_date": "2026-09-16T14:37:36.550000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Do not allow untrusted users to control AMQP QoS prefetch settings. Validate configured values are non-negative, and update applications using amqp091-go when a fixed version is available.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting"
    },
    {
      "cve": "CVE-2026-77409",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-16T14:52:41.339550+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. When the client synchronously sends events to application-provided channels, an unbuffered or full listener channel can cause the client\u0027s reader to block. This blockage prevents the processing of critical messages and heartbeats, leading to connection stalls, deadlocks, and disconnections. This vulnerability can result in a Denial of Service (DoS) for applications using the affected component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact because a broker-driven event burst can block AMQP client processing when application notification channels are unbuffered, full, or not promptly drained. The resulting stall can cause missed heartbeats, deadlocks, or client disconnection.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77409"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/349",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/349"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j"
        }
      ],
      "release_date": "2026-09-16T14:48:00.669000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Use adequately buffered notification channels and ensure event consumers continuously drain them. Update applications using amqp091-go when a fixed version is available.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking"
    },
    {
      "cve": "CVE-2026-77410",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-16T14:54:20.609828+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535500"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send an extreme declared message body size to a client. This causes the client to attempt an excessively large memory allocation without proper size capping, leading to memory exhaustion and termination of the client process. This vulnerability results in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77410"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535500",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535500"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77410",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77410"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77410",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77410"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/346",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/346"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh"
        }
      ],
      "release_date": "2026-09-16T14:39:08.872000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation"
    },
    {
      "cve": "CVE-2026-77412",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-09-16T14:54:07.329706+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535499"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send a specially crafted AMQP (Advanced Message Queuing Protocol) message with a malformed field length. This can cause an integer overflow, leading to a runtime panic in the client process. Consequently, the client process terminates, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact because a malicious or compromised AMQP broker can send a malformed field length that causes the client process to panic and terminate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77412"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535499",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535499"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77412",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77412"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77412",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77412"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/344",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
        }
      ],
      "release_date": "2026-09-16T14:43:46.302000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Connect only to trusted AMQP brokers, protect broker credentials and transport security, and update applications using amqp091-go when a fixed version is available.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length"
    },
    {
      "cve": "CVE-2026-79921",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-26T21:01:49.454950+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524713"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the amqp091-go client can lead to a denial of service in Red Hat products. A compromised or malicious AMQP broker could exploit this by sending oversized payloads, forcing the client to consume excessive memory and potentially causing application-layer service disruption. The impact is considered Important due to the potential for resource exhaustion and disruption of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524713",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524713"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/353",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/353"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"
        }
      ],
      "release_date": "2026-08-26T20:24:58.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads"
    },
    {
      "cve": "CVE-2026-82417",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-08-30T00:00:50.379994+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525936"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object\u0027s constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qs: qs: Denial of Service via improper validation in stringify function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service vulnerability was found in the qs package for Node.js. The stringify function does not verify that constructor.isBuffer is callable before invoking it. An attacker who can influence object shape, for example through query parameters parsed with allowPrototypes: true as Express 4 does by default, can cause qs.stringify to throw a TypeError when that data is re-serialized. In typical Node.js HTTP frameworks the error is caught per request and returns HTTP 500. In code paths without an error boundary, such as async handlers or background jobs, the process may exit.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525936",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525936"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82417",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6",
          "url": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g",
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"
        }
      ],
      "release_date": "2026-08-29T23:51:27.634000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qs: qs: Denial of Service via improper validation in stringify function"
    },
    {
      "cve": "CVE-2026-84292",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-02T20:21:15.599288+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Applications utilizing the `fast-uri` library in Red Hat environments are susceptible to authority injection if they process untrusted data as the port component of a URI. This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
        }
      ],
      "release_date": "2026-09-02T20:09:51.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
    },
    {
      "cve": "CVE-2026-84394",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-09-02T20:31:21.036047+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit URI parsing discrepancies to bypass critical host-level access restrictions, such as SSRF filters or reverse proxy routing, without needing elevated privileges. Within Red Hat environments, the issue primarily impacts services that rely on fast-uri to validate external destinations before dispatching requests via Node.js HTTP clients. Product components that only provide frontend interfaces or do not evaluate host security policies using the parsed authority data are not exposed to security filter circumvention.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
        }
      ],
      "release_date": "2026-09-02T20:25:35.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
    },
    {
      "cve": "CVE-2026-87776",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-09-11T11:40:59.000487+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `compression` Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "compression: compression: Denial of Service via memory leak on premature response close",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as Important. A remote unauthenticated attacker can cause a denial of service by repeatedly aborting connections while compressed responses are being sent, which can lead to memory exhaustion and server termination.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87776"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95",
          "url": "https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95"
        }
      ],
      "release_date": "2026-09-11T11:24:55.150000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-07T15:14:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:77656"
        },
        {
          "category": "workaround",
          "details": "Update the compression middleware to version 1.8.2 or later. No supported workaround is currently available if the affected version cannot be updated.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cb5021166e79bc7a3410ca5a8b50d8327a681d9ec66cfb2b44aa36c9a8b22e5b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:044a80a50382e6b9833811b6e5fa9a81427780332aaab3096302681abeecd8f1_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "compression: compression: Denial of Service via memory leak on premature response close"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.