CVE-2026-32590

HIGH7.1Insecure deserialization

Description

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

RedHat / mirror_registry_for_red_hat_openshift
RedHat / mirror_registry_for_red_hat_openshift2.0 – 2.0
RedHat / quay3.0.0 – 3.0.0

References

VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:19375
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:21017
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:22465
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:22629
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:22840
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:23361
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:24833
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:24853
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28441
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:48085
VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-32590
MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2446964

Updated 21m ago · 8 sources