Red Hat Security Advisory: Red Hat Quay 3.17.5

Red Hat Quay versions prior to 3.9.26 contain multiple security vulnerabilities affecting the logging subsystem used in Red Hat OpenShift and related components. These vulnerabilities are addressed in the Red Hat Quay 3.9.26 update. The advisory highlights the importance of applying this update to remediate the issues.

• CWE-617Reachable Assertion (opens in a new tab)

  Base weakness

  The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

  How to prevent and test

  1. Implementation

     Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)

  2. Implementation · Input Validation

     Perform input validation on user data.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)

  Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)

  The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

  How to prevent and test

  1. Architecture and Design · Attack Surface Reduction

     Store state information and sensitive data on the server side only.

  2. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  3. Architecture and Design

     For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

  OWASP Cheat Sheets

  • Secure Design Principles (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-863Incorrect Authorization (opens in a new tab)

  Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

  How to prevent and test

  1. Architecture and Design

     Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.

  2. Architecture and Design

     Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.

  3. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.3.8 (opens in a new tab)
  • V13.4.2 (opens in a new tab)
  • V7.2.2 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-764Multiple Locks of a Critical Resource (opens in a new tab)

  Base weakness

  The product locks a critical resource more times than intended, leading to an unexpected state in the system.

  How to prevent and test

  1. Implementation

     When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)

  The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

  How to prevent and test

  1. Operation

     If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

  2. Implementation

     Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  Attack patterns

  • Exponential Data Expansion (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  2. Architecture and Design

     For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

  3. Implementation · Input Validation

     Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.3.1 (opens in a new tab)

  Attack patterns

  • Path Traversal (opens in a new tab)
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
  • Manipulating Web Input to File System Calls (opens in a new tab)
  • Using Escaped Slashes in Alternate Encoding (opens in a new tab)
  • Using Slashes in Alternate Encoding (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

  How to prevent and test

  1. Architecture and Design

     Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

  2. System Configuration

     Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

  3. Implementation

     Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  Attack patterns

  • Regular Expression Exponential Blowup (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)

  Base weakness

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

• CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  How to prevent and test

  1. Requirements

     Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

  2. Architecture and Design

     Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

  3. Architecture and Design

     Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.1.4 (opens in a new tab)
  • V13.4.1 (opens in a new tab)
  • V11.1.4 (opens in a new tab)

  Attack patterns

  • XML Ping of the Death (opens in a new tab)
  • Exponential Data Expansion (opens in a new tab)
  • Serialized Data Parameter Blowup (opens in a new tab)
  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

  How to prevent and test

  1. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Implementation · Architecture and Design

     Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.

  3. Architecture and Design · Implementation · Attack Surface Reduction

     Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…

  OWASP Cheat Sheets

  • Cross Site Scripting Prevention (opens in a new tab)
  • DOM based XSS Prevention (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.3.3 (opens in a new tab)
  • V1.5.1 (opens in a new tab)

  Attack patterns

  • XSS Using MIME Type Mismatch (opens in a new tab)
  • DOM-Based XSS (opens in a new tab)
  • Reflected XSS (opens in a new tab)
  • Stored XSS (opens in a new tab)
  • Cross-Site Scripting (XSS) (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)

  Base weakness

  The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

  How to prevent and test

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-839Numeric Range Comparison Without Minimum Check (opens in a new tab)

  Base weakness

  The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

  How to prevent and test

  1. Implementation · Enforcement by Conversion

     If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.

  2. Implementation · Input Validation

     If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-674Uncontrolled Recursion (opens in a new tab)

  Class weakness

  The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

  How to prevent and test

  1. Implementation

     Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

  2. Implementation

     Increase the stack size.

  Attack patterns

  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)

  Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)

  The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

  How to prevent and test

  1. Implementation

     If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.

  2. Architecture and Design · Implementation

     If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

  3. Implementation · Input Validation

     For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

  OWASP Cheat Sheets

  • Mass Assignment (opens in a new tab)
  • Software Supply Chain Security (opens in a new tab)
  • Infrastructure as Code (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.1.2 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1241Use of Predictable Algorithm in Random Number Generator (opens in a new tab)

  Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)

  The device uses an algorithm that is predictable and generates a pseudo-random number.

  How to prevent and test

  1. Architecture and Design

     It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.

  2. Implementation

     It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.

  OWASP Cheat Sheets

  • Forgot Password (opens in a new tab)
  • Transport Layer Protection (opens in a new tab)
  • User Privacy Protection (opens in a new tab)
  • Password Storage (opens in a new tab)
  • Cryptographic Storage (opens in a new tab)

  OWASP ASVS 4.0.3

  • V2.3.1 (opens in a new tab)
  • V2.6.2 (opens in a new tab)
  • V2.7.6 (opens in a new tab)

  Attack patterns

  • Cryptanalysis (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-59Improper Link Resolution Before File Access ('Link Following') (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

  How to prevent and test

  1. Architecture and Design · Separation of Privilege

     Follow the principle of least privilege when assigning access rights to entities in a software system.

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  Attack patterns

  • Symlink Attack (opens in a new tab)
  • Using Malicious Files (opens in a new tab)
  • Leverage Executable Code in Non-Executable Files (opens in a new tab)
  • Manipulating Web Input to File System Calls (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-281Improper Preservation of Permissions (opens in a new tab)

  Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

  How to prevent and test

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.3.8 (opens in a new tab)
  • V13.4.2 (opens in a new tab)
  • V7.2.2 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

  How to prevent and test

  1. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Implementation

     It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…

  3. Operation · Architecture and Design · Resource Limitation

     Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.

  Attack patterns

  • HTTP DoS (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)

  Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • Padding Oracle Crypto Attack (opens in a new tab)
  • Signature Spoofing by Improper Validation (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-476NULL Pointer Dereference (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)

  The product dereferences a pointer that it expects to be valid but is NULL.

  How to prevent and test

  1. Implementation

     For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

  2. Requirements

     Select a programming language that is not susceptible to these issues.

  3. Implementation

     Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

  OWASP Cheat Sheets

  • Logging (opens in a new tab)
  • Error Handling (opens in a new tab)

  OWASP ASVS 4.0.3

  • V11.1.7 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-295Name not in the CWE catalogue (opens in a new tab)
• CWE-303Name not in the CWE catalogue (opens in a new tab)
• CWE-681Name not in the CWE catalogue (opens in a new tab)
• CWE-1285Name not in the CWE catalogue (opens in a new tab)
• CWE-606Name not in the CWE catalogue (opens in a new tab)
• CWE-1341Name not in the CWE catalogue (opens in a new tab)
• CWE-1289Name not in the CWE catalogue (opens in a new tab)
• CWE-1284Name not in the CWE catalogue (opens in a new tab)
• CWE-358Name not in the CWE catalogue (opens in a new tab)
• CWE-1046Name not in the CWE catalogue (opens in a new tab)
• CWE-78Name not in the CWE catalogue (opens in a new tab)
• CWE-256Name not in the CWE catalogue (opens in a new tab)
• CWE-166Name not in the CWE catalogue (opens in a new tab)
• CWE-601Name not in the CWE catalogue (opens in a new tab)
• CWE-140Name not in the CWE catalogue (opens in a new tab)
• CWE-125Name not in the CWE catalogue (opens in a new tab)
• CWE-787Name not in the CWE catalogue (opens in a new tab)
• CWE-190Name not in the CWE catalogue (opens in a new tab)
• CWE-409Name not in the CWE catalogue (opens in a new tab)
• CWE-131Name not in the CWE catalogue (opens in a new tab)
• CWE-843Name not in the CWE catalogue (opens in a new tab)

• access.redhat.com/errata/RHSA-2026:65514 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-15792 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-16221 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-18255 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-32283 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-33818 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-44705 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-49477 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56852 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56853 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56858 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56859 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56860 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56862 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67213 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67214 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67313 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67314 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67320 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67321 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:66084 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-69152 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:66521 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-17106 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-18140 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-29181 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-35469 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39828 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39830 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39831 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39832 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39835 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-41178 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42508 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-46595 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-46597 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-46604 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:66523 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:66022 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-25681 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-27136 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-27145 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-33811 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39820 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39821 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39829 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39833 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42499 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42502 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42504 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:68349 (opens in a new tab)
• access.redhat.com/security/updates/classification/ (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68349.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:74511 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-39822 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42151 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42154 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-49825 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54770 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:81110 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54058 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55379 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55380 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59197 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59199 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59200 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59204 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59205 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59886 (opens in a new tab)

• CVE-2026-15792: CWE-20: Improper Input Validation in moby BuildKitMediumVulnerability07/21/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.CriticalVulnerability10/22/2026