VDB
RHSA-2026:74511
RHSA-2026:74511
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Record from redhat · Published October 1, 2026
A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.
Risk scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le as a component of Red Hat Quay 3.17 | * |
…and 11 more
Timeline
- Oct 1, 2026 CVE Published
- Oct 2, 2026 Security Advisory (65 in total, the first dated here)
- Oct 15, 2026 CVE Updated
- Oct 15, 2026 Distribution Patch (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:74511
vulnetix vdb fixes RHSA-2026:74511Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A74511/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500752 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49477 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49477 advisory
- https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3 advisory
- https://github.com/facelessuser/soupsieve/releases/tag/2.8.4 advisory
- https://access.redhat.com/errata/RHSA-2026:74511 advisory
- https://access.redhat.com/security/cve/CVE-2026-15792 advisory
- https://access.redhat.com/security/cve/CVE-2026-16221 advisory
- https://access.redhat.com/security/cve/CVE-2026-18255 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39822 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-44705 advisory
- https://access.redhat.com/security/cve/CVE-2026-49477 advisory
- https://access.redhat.com/security/cve/CVE-2026-49825 advisory
…and 416 more