Red Hat Security AdvisoryRHSA-2026:62515
Red Hat build of Quarkus 3.27.5.SP1 release and security update
Released 2026-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7
Fixes 13 records
Priority MEDIUM 47
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00331 · Published 2026-08-11 · Partial fix CWE-295
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 42
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00968 · Published 2026-08-31 · Partial fix · 3.27.5.SP1, 3.33.3.SP1 +2 CWE-1336
Priority MEDIUM 40
A flaw was found in SmallRye GraphQL.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00793 · Published 2026-08-31 · Fixed in 2.14.2.redhat-00002, 2.17.0.redhat-00003 CWE-1284
Priority MEDIUM 40
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix · 0.35.0 CWE-674
Priority MEDIUM 40
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix CWE-789
Priority MEDIUM 40
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix CWE-770
Priority MEDIUM 40
A flaw was found in RESTEasy's SourceProvider.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0085 · Published 2026-08-31 · Partial fix · 6.2.16.Final-redhat-00003, 26.6.7-3 +6 CWE-611
Priority LOW 35
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization.
CVSS 4.0HIGH 8.2· Local · Low privileges · No interaction · EPSS 0.00145 · Published 2026-08-11 · Partial fix · 5.9.2 CWE-532
Priority LOW 34
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00343 · Published 2026-09-08 · Fixed CWE-639
Priority LOW 33
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-08-17 · Partial fix · 4.1.137.Final, 4.2.17.Final CWE-524
Priority LOW 30
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response mes…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00464 · Published 2026-07-31 · Partial fix · 5.6.3 CWE-772
Priority LOW 30
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-09-08 · Partial fix CWE-284
THREATIST.IORead the docs