Red Hat Security Advisory

RHSA-2026:1965

Red Hat build of Quarkus 3.27.2 release and security update

Released 2026-02-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.27.2.redhat com.ongres.scram.scram-common-3.2.0.redhat-00001.jar, io.netty.netty-codec-http-4.1.130.Final-redhat-00001.jar, io.quarkus.quarkus-rest-3.27.2.redhat-00001.jar +1

Fixes 4 records

TI-2025-41431 CVE-2025-67735 · GHSA-84h7-rjj3-6jx4

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

HIGH 68

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0032 Published 2025-12-16 Partial fix · 4.2.8.Final, 4.1.129.Final CWE-93

TI-2025-36984 CVE-2025-59432 · GHSA-3wfh-36rx-9537

Timing Attack Vulnerability in SCRAM Authentication

LOW 36

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00702 Published 2025-09-22 Partial fix · 3.2 CWE-208

TI-2025-40971 CVE-2025-66560 · GHSA-5rfx-cp42-p624

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

LOW 33

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00383 Published 2026-01-07 Partial fix · 3.31.0, 3.27.2 +1 CWE-770

TI-2025-13654 CVE-2025-14969 · GHSA-frpp-8pwq-hjrx

Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect

LOW 20

A flaw was found in Hibernate Reactive.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00408 Published 2026-01-26 Fixed in 3.1.12.Final-redhat-00001, 4.2.1 CWE-772