This vulnerability arises from Red Hat Quay's process of storing intermediate data during resumable container image layer uploads in a format vulnerable to tampering. An attacker who can manipulate this data could exploit insecure deserialization to execute arbitrary code on the server hosting Quay. The CVSS 3.1 base score is 7.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and user interaction with high attack complexity. Red Hat has published security advisories (RHSA-2026:19375 and RHSA-2026:21017) that include fixed versions of Red Hat Quay (3.16.4 and 3.14.8) addressing this vulnerability.

Successful exploitation allows an attacker to execute arbitrary code on the Red Hat Quay server, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the service. The attack requires network access, low privileges, and user interaction, with high attack complexity.

Red Hat has released fixed versions of Red Hat Quay (3.16.4 and 3.14.8) that address this vulnerability. Users should apply these updates after ensuring all previously released errata relevant to their system have been applied. Refer to Red Hat advisories RHSA-2026:19375 and RHSA-2026:21017 for detailed update instructions. Patch status is confirmed by the vendor advisories. No additional mitigations are specified.