{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/quay/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*","cpe:2.3:a:exrick:xmall:1.1:*:*:*:*:*:*:*","cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*","cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2023-36331"},{"cvss":4.4,"id":"CVE-2024-37891"},{"cvss":5.9,"id":"CVE-2023-43804"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Quay","Enterprise Linux"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","red-hat","linux","denial-of-service"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eRed Hat has identified multiple security vulnerabilities impacting Red Hat Quay and Red Hat Enterprise Linux. These flaws stem from vulnerabilities within the integrated pypdf and urllib3 libraries, as well as specific issues in URI handling mechanisms. Remote, unauthenticated attackers can leverage these weaknesses to trigger Denial of Service (DoS) conditions, effectively disrupting service availability, or bypass existing security restrictions. The affected CVEs include CVE-2023-36331, CVE-2024-37891, and CVE-2023-43804. Defenders should prioritize patching, as these libraries are common dependencies within containerized environments and enterprise infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities allows for service degradation or unauthorized security bypasses in Red Hat-based environments. These flaws pose a risk to the availability and integrity of Red Hat Quay registries and host operating systems. The potential for DoS attacks against critical container infrastructure could lead to significant operational disruption in enterprise sectors relying on these products.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Red Hat Quay and Red Hat Enterprise Linux instances to the versions specified in the official Red Hat security advisories.\u003c/li\u003e\n\u003cli\u003eReview dependencies within container images hosted on Quay to identify and update instances of pypdf and urllib3.\u003c/li\u003e\n\u003cli\u003eAudit network ingress traffic for malformed URI patterns that may attempt to trigger resource exhaustion or bypass logic in web-facing components.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T14:07:18Z","date_published":"2026-10-19T14:07:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-red-hat-vulnerabilities/","summary":"Red Hat Quay and Red Hat Enterprise Linux are affected by vulnerabilities in the pypdf and urllib3 libraries, alongside URI handling flaws, allowing remote unauthenticated attackers to perform Denial of Service or security bypasses.","title":"Multiple Vulnerabilities in Red Hat Quay and Enterprise Linux","url":"https://feed.craftedsignal.io/briefs/2026-10-red-hat-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Quay","version":"https://jsonfeed.org/version/1.1"}