Red Hat Security Advisory

RHSA-2024:6437

Red Hat build of Quarkus 3.8.6 release and security update

Released 2024-09-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.8.6.redhat io.quarkus.http.quarkus-http-core-5.2.4.redhat-00001.jar, io.vertx.vertx-grpc-client-4.5.7.redhat-00003.jar, io.vertx.vertx-grpc-server-4.5.7.redhat-00003.jar

Fixes 2 records

TI-2024-07780 CVE-2024-8391 · GHSA-g76f-gjfx-4rpr

Eclipse Vert.x gRPC server does not limit the maximum message size

LOW 37

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0058 Published 2024-09-04 Partial fix · 4.5.10 CWE-770

TI-2024-03408 CVE-2024-3653 · GHSA-ch7q-gpff-h9hp

Undertow: learningpushhandler can lead to remote memory dos attacks

LOW 34

A vulnerability was found in Undertow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01866 Published 2024-07-08 Partial fix · 5.2.4.redhat-00001, 2.2.33.SP1-redhat-00001 +5 CWE-401