RHSA-2026:74511 - Security Advisory

Topic

Red Hat Quay 3.17.5 is now available with bug fixes.

Description

Quay 3.17.5

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Quay

Fixes

• PROJQUAY-12812 - Limit Clair scanning of images to at most n attempts
• PROJQUAY-12792 - Clean up orphaned multipart uploads as part of blob cleanup work
• PROJQUAY-12416 - Repository mirroring does not work on 3.17.x when both source and destination are the same registry
• PROJQUAY-12393 - V2 UI routing bug: malformed API requests when organization name contains the "organization" word
• PROJQUAY-12373 - Implement volumeSize and storageClassName overrides for Clair ephemeral volume
• PROJQUAY-12227 - [New UI]: Missing repository name in breadcrumb when tag name same with repo name
• PROJQUAY-12200 - Quay build_start notification event is never triggered
• PROJQUAY-12199 - Pulling of cached image from Quay requires upstream registry availability
• PROJQUAY-11975 - Redact LDAP passwords when USERS_DEBUG=1 is enabled
• PROJQUAY-11855 - Optimize UI loading
• PROJQUAY-11723 - Playwright: Add build notification delivery tests (email/webhook)
• PROJQUAY-11692 - Quay New UI: Superuser Build Logs page returns 500 error due to BuildTrigger.to_dict() logic bug
• PROJQUAY-11689 - Lazy load of OCI indexes does not tolerate Docker v2 schema 2 images in the index
• PROJQUAY-11688 - Optimize GC queries
• PROJQUAY-11685 - [redhat-3.17] feat(ldap): add queue-based admin connection pool to eliminate per-request TCP/TLS/bind overhead
• PROJQUAY-11682 - Autopruner matching on .sig tags instead of filtering them
• PROJQUAY-11580 - Quay New UI Usage Logs chart legend overlaps chart area making both unreadable
• PROJQUAY-11557 - Quay 3.18 Operator rejects "PULL_METRICS_REDIS" in configBundleSecret when Redis is managed after config-tool migration
• PROJQUAY-11441 - Click one permission in the permission dropdown list will go to "This site is temporarily unavailable" page in Firefox
• PROJQUAY-11350 - onfig-tool: malformed struct tag on DistributedStorageArgs.Signature breaks storage config serialization [quay-3.9]
• PROJQUAY-11349 - config-tool: malformed struct tag on DistributedStorageArgs.Signature breaks storage config serialization [quay-3.10]

CVEs

• CVE-2026-15792
• CVE-2026-16221
• CVE-2026-18255
• CVE-2026-33818
• CVE-2026-39820
• CVE-2026-39822
• CVE-2026-42151
• CVE-2026-42154
• CVE-2026-42499
• CVE-2026-42504
• CVE-2026-44705
• CVE-2026-49477
• CVE-2026-49825
• CVE-2026-54770
• CVE-2026-56852
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-67213
• CVE-2026-67214
• CVE-2026-67313
• CVE-2026-67314
• CVE-2026-67320
• CVE-2026-67321
• CVE-2026-69153
• CVE-2026-84292
• CVE-2026-84394

References

• https://access.redhat.com/security/updates/classification/