RHSA-2026:19375 - Security Advisory

Topic

Red Hat Quay 3.16.4 is now available with bug fixes.

Description

Quay 3.16.4

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Quay

Fixes

• PROJQUAY-11579 - Quay new UI Login page branding logo is invisible
• PROJQUAY-11578 - Quay 3.16.4 Operator rejects "PULL_METRICS_REDIS" in configBundleSecret when Redis is managed after config-tool migration
• PROJQUAY-11544 - Quay new UI Verify User can't sign in with OIDC provider
• PROJQUAY-11435 - Quay's is_jwt() rejects RFC 9068 access tokens with typ: at+jwt
• PROJQUAY-11334 - config-tool: malformed struct tag on DistributedStorageArgs.Signature breaks storage config serialization
• PROJQUAY-11174 - Quay's is_jwt() rejects RFC 9068 access tokens with typ: at+jwt
• PROJQUAY-10884 - Migrate to PatternFly6
• PROJQUAY-10872 - repositorygcworker fails to delete images with "Population must be a sequence" error.

CVEs

• CVE-2025-61726
• CVE-2025-62718
• CVE-2026-2377
• CVE-2026-25679
• CVE-2026-27137
• CVE-2026-27459
• CVE-2026-27962
• CVE-2026-28802
• CVE-2026-29063
• CVE-2026-29074
• CVE-2026-30922
• CVE-2026-32280
• CVE-2026-32282
• CVE-2026-32286
• CVE-2026-32589
• CVE-2026-32590
• CVE-2026-32597
• CVE-2026-33186
• CVE-2026-33894
• CVE-2026-34986
• CVE-2026-39892
• CVE-2026-40192
• CVE-2026-40895
• CVE-2026-42033
• CVE-2026-42035
• CVE-2026-42039
• CVE-2026-42041
• CVE-2026-42043
• CVE-2026-42044
• CVE-2026-4427
• CVE-2026-4598
• CVE-2026-4599
• CVE-2026-4600
• CVE-2026-4601
• CVE-2026-4602

References

• https://access.redhat.com/security/updates/classification/