Red Hat Security Advisory

RHSA-2026:11721

Red Hat build of Quarkus 3.27.3.SP1 security update

Released 2026-05-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.27.3.SP1 io.quarkus.quarkus-vertx-http-3.27.3.redhat-00002.jar, org.apache.kafka.kafka-clients-4.0.2.redhat-00001.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +1

TI-2025-13517 CVE-2025-14813 · GHSA-574f-3g2m-x479

MEDIUM 42

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0CRITICAL 9.3 Local No auth No interaction EPSS 0.0032 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-327

TI-2026-28734 CVE-2026-39852 · GHSA-rc95-pcm8-65v9

LOW 39

Quarkus is a Java framework for building cloud-native applications.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00712 Published 2026-05-05 Partial fix · 3.20.6.1, 3.27.3.1 +4 CWE-863

TI-2026-27662 CVE-2026-35554 · GHSA-5qcv-4rpc-jp93

LOW 38

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00454 Published 2026-04-07 Partial fix · 3.9.2, 4.0.2 +1 CWE-362

TI-2026-04899 CVE-2026-5588 · GHSA-wg6q-6289-32hp

LOW 35

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00777 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +4 CWE-327

TI-2026-00434 CVE-2026-0636 · GHSA-c3fc-8qff-9hwx

LOW 31

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00527 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-90