Vulnerabilities of Red Hat mirror registry for Red Hat OpenShift

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-85471	A flaw was found in Quay	6.4 Medium	Oct 12, 2026
CVE-2026-33811	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…	7.5 High	May 7, 2026
CVE-2026-32591	A flaw was found in Red Hat Quay's Proxy Cache configuration feature	5.2 Medium	Apr 8, 2026
CVE-2026-32590	A flaw was found in Red Hat Quay's handling of resumable container image layer uploads	7.1 High	Apr 8, 2026
CVE-2026-32589	A flaw was found in Red Hat Quay's container image upload process	7.4 High	Apr 8, 2026
CVE-2025-14243	A flaw was found in the OpenShift Mirror Registry	5.3 Medium	Apr 8, 2026
CVE-2026-2377	A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift	6.5 Medium	Apr 8, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…	7.5 High	Apr 8, 2026
CVE-2026-2376	A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended…	4.9 Medium	Mar 12, 2026
CVE-2026-25679	url.Parse insufficiently validated the host/authority component and accepted some invalid URLs	7.5 High	Mar 6, 2026
CVE-2026-27137	When verifying a certificate chain which contains a certificate containing multiple email address constraints which…	7.5 High	Mar 6, 2026
CVE-2025-61726	The net/url package does not set a limit on the number of query parameters in a query	7.5 High	Jan 28, 2026
CVE-2025-7777	The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker…	6.5 Medium	Aug 20, 2025
CVE-2025-3528	A flaw was found in the Mirror Registry	8.2 High	May 9, 2025
CVE-2024-3625	A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file	7.3 High	Apr 25, 2024
CVE-2024-3624	A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file	7.3 High	Apr 25, 2024
CVE-2024-3623	A flaw was found when using mirror-registry to install Quay	6.5 Medium	Apr 25, 2024
CVE-2024-3622	A flaw was found when using mirror-registry to install Quay	8.8 High	Apr 25, 2024

Other Red Hat products