Red Hat Security AdvisoryRHSA-2026:36013
Red Hat build of Quarkus 3.33.2.SP2 security update
Released 2026-07-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.keycloak.keycloak-policy-enforcer-26.0.10.redhat-00001.jar
Fixes 10 records
Priority HIGH 70
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01066 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01226 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00792 · Published 2026-06-09 · Partial fix · 1.16.5.1, 1.15.11.1 +7 CWE-400
Priority MEDIUM 40
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00631 · Published 2026-06-09 · Partial fix · 1.16.5.1, 1.15.11.1 +2 CWE-400
TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252 Priority LOW 38
A flaw was found in Keycloak Policy Enforcer.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00651 · Published 2026-06-25 · Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025
Priority LOW 35
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00354 · Published 2026-06-23 · Partial fix · 2.21.4, 3.1.4 CWE-863
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00384 · Published 2026-06-23 · Partial fix · 2.21.4, 3.1.4 CWE-863
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00449 · Published 2026-06-23 · Partial fix · 2.21.4, 3.1.4 CWE-915
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-06-23 · Partial fix · 2.18.9, 2.21.5 +2 CWE-915
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00368 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-918
THREATIST.IORead the docs