Read the docs
TI-2024-01605 Aliases CVE-2024-1726GHSA-mv64-86g8-cqq7

Quarkus: security checks for some inherited endpoints performed after serialization in…

Priority LOW 31CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00727 54th percentileScored 2026-11-07
Fix Partial quarkus-resteasy-reactive: 3.2.11.Final, 3.7.4, 3.8.0io.quarkus.resteasy.reactive:resteasy-reactive (Maven): 3.8.0, 3.7.4, 3.2.11.FinalRed Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—quarkus-resteasy-reactivebefore 3.2.11.Final; 3.3.0.CR1 to before 3.7.4; 3.8.0.CR13.2.11.Final, 3.7.4, 3.8.0Patch availableCNA
Red HatRed Hat build of Quarkus 3.2.11.Final—3.2.11.Final-redhat-00001Patch availableCNA
Red HatRed Hat build of Quarkus——No fix listedCNA
—io.quarkus.resteasy.reactive:resteasy-reactive (Maven)3.8.0.CR1 to before 3.8.03.8.0Patch availableGHSA-mv64-86g8-cqq7
—io.quarkus.resteasy.reactive:resteasy-reactive (Maven)3.3.0.CR1 to before 3.7.43.7.4Patch availableGHSA-mv64-86g8-cqq7
—io.quarkus.resteasy.reactive:resteasy-reactive (Maven)before 3.2.11.Final3.2.11.FinalPatch availableGHSA-mv64-86g8-cqq7
  • quarkus-resteasy-reactive Vendor— Affected before 3.2.11.Final; 3.3.0.CR1 to before 3.7.4; 3.8.0.CR1 Fixed in 3.2.11.Final, 3.7.4, 3.8.0 Patch available CNA
  • Red Hat build of Quarkus 3.2.11.Final VendorRed Hat Affected — Fixed in 3.2.11.Final-redhat-00001 Patch available CNA
  • Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
  • io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Vendor— Affected 3.8.0.CR1 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-mv64-86g8-cqq7
  • io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Vendor— Affected 3.3.0.CR1 to before 3.7.4 Fixed in 3.7.4 Patch available GHSA-mv64-86g8-cqq7
  • io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Vendor— Affected before 3.2.11.Final Fixed in 3.2.11.Final Patch available GHSA-mv64-86g8-cqq7

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:/a:redhat:quarkus:3.2::el83.2—Red Hat
cpe:/a:redhat:quarkus:22—Red Hat
  • cpe:/a:redhat:quarkus:3.2::el8 Versions 3.2 — ·Red Hat
  • cpe:/a:redhat:quarkus:2 Versions 2 — ·Red Hat

Remediation

  • Fix · CNA quarkus-resteasy-reactive Fixed in 3.2.11.Final, 3.7.4, 3.8.0
  • Fix · GHSA-mv64-86g8-cqq7 io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Fixed in 3.8.0 Advisory →
  • Fix · GHSA-mv64-86g8-cqq7 io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Fixed in 3.7.4 Advisory →
  • Fix · GHSA-mv64-86g8-cqq7 io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Fixed in 3.2.11.Final Advisory →

Red Hat 1 advisory

  • RHSA-2024:1662 Released 2024-04-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.11 release and security update
    • Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of QuarkusAffectedNo fix yet: Fix deferred
Red Hat build of Quarkus 3.2.11.FinalFixed RHSA-2024:1662
Not affected: 1 product
  • Red Hat build of Quarkus 3.2.11.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1726
  2. 2026-10-03 Alias added: GHSA-mv64-86g8-cqq7

References

Advisory 2

Other 5

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences