RHSA-2026:99022 - Security Advisory

Topic

Red Hat Quay v3.16.7

Description

Red Hat Quay is a container image registry for building, distributing, and deploying containers.

This advisory contains the container images for Red Hat Quay 3.16.7. See the following Release Notes documentation for additional details about this release:

https://docs.redhat.com/en/documentation/red_hat_quay/3.16/html/red_hat_quay_release_notes/index

Solution

Before you apply this update, make sure all previously released errata that are relevant to your system are applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Quay

Fixes

• BZ - 2520368
• BZ - 2524713
• BZ - 2527747
• BZ - 2527756
• BZ - 2535489
• BZ - 2535493
• BZ - 2535494
• BZ - 2535498
• BZ - 2535499
• BZ - 2535500
• BZ - 2538368
• BZ - 2542566
• BZ - 2542685
• BZ - 2542690
• BZ - 2542695
• BZ - 2542697
• BZ - 2543245
• BZ - 2543255
• BZ - 2544270
• BZ - 2544277
• BZ - 2544283
• BZ - 2544294
• BZ - 2544307
• BZ - 2544308
• BZ - 2552249
• BZ - 2555848
• BZ - 2563201
• BZ - 2568072
• PROJQUAY-11694 - Lazy load of OCI indexes does not tolerate Docker v2 schema 2 images in the index
• PROJQUAY-13319 - Quay New UI: Superuser Build Logs page returns 500 error due to BuildTrigger.to_dict() logic bug
• PROJQUAY-13322 - Quay 3.18.0 New UI: Superuser Build Logs page shows 'No logs available' for archived builds
• PROJQUAY-13337 - Quota enforcement: rejected blob uploads leave orphaned BlobUpload rows that permanently block subsequent pushes
• PROJQUAY-13419 - 'quota update error, Unauthorized' when changing organization quota limit using v2 UI
• PROJQUAY-14044 - Archived build logs return 500 on GCS storage: zlib "incorrect header check" when GCS serves an already-decoded object

CVEs

• CVE-2026-102267
• CVE-2026-102268
• CVE-2026-102272
• CVE-2026-102273
• CVE-2026-102994
• CVE-2026-102996
• CVE-2026-102997
• CVE-2026-102998
• CVE-2026-102999
• CVE-2026-103000
• CVE-2026-110642
• CVE-2026-112390
• CVE-2026-118669
• CVE-2026-123710
• CVE-2026-49825
• CVE-2026-77403
• CVE-2026-77404
• CVE-2026-77406
• CVE-2026-77409
• CVE-2026-77410
• CVE-2026-77412
• CVE-2026-79921
• CVE-2026-84292
• CVE-2026-84394
• CVE-2026-93749
• CVE-2026-94603
• CVE-2026-97687
• CVE-2026-97689

References

• https://access.redhat.com/security/updates/classification/