Read the docs
TI-2026-13631 Aliases CVE-2026-16308GHSA-g8rv-gp9f-q875

IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 10 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMEnterprise Build of Quarkus3.27.1 – 3.27.4.SP2; 3.33.1 – 3.33.2.SP2—No fix listedCNA
  • Enterprise Build of Quarkus VendorIBM Affected 3.27.1 – 3.27.4.SP2; 3.33.1 – 3.33.2.SP2 Fixed in — No fix listed CNA

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*3.27.1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:*3.27.4.sp2—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:*3.27.4.sp2 sp2—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*3.33.1—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:*3.33.2.sp2—IBM
cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:*3.33.2.sp2 sp2—IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:* Versions 3.27.1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:* Versions 3.27.4.sp2 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:* Versions 3.27.4.sp2 sp2 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:* Versions 3.33.1 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:* Versions 3.33.2.sp2 — ·IBM
  • cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:* Versions 3.33.2.sp2 sp2 — ·IBM

Remediation

Red Hat 10 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
Show 7 more Red Hat advisories
  • RHSA-2026:50849 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.5 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:50847 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.14 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:50846 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.14 Security Update
    • Red Hat build of Keycloak 26.4.14
  • RHSA-2026:50848 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.5 Security Update
    • Red Hat build of Keycloak 26.6.5
  • RHSA-2026:48118 Released 2026-07-30 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
    • Red Hat Build of Apache Camel 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +9
  • RHSA-2026:47172 Released 2026-07-30 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.2.SP3 security update
    • Red Hat build of Quarkus 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +3
  • RHSA-2026:47189 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.4.SP3 security update
    • Red Hat build of Quarkus 3.27.4.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix planned: Out of support scope
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Red Hat Build of Apache Camel 3.33.2.SP3Fixed RHSA-2026:48118
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat build of Keycloak 26.4Fixed RHSA-2026:50847
Red Hat build of Keycloak 26.4.14Fixed RHSA-2026:50846
Red Hat build of Keycloak 26.6Fixed RHSA-2026:50849
Red Hat build of Keycloak 26.6.5Fixed RHSA-2026:50848
Red Hat build of Quarkus 3.27.4.SP3Fixed RHSA-2026:47189
Red Hat build of Quarkus 3.33.2.SP3Fixed RHSA-2026:47172
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 9 products
  • Cryostat 4 on RHEL 9
  • Red Hat Build of Apache Camel 3.33.2.SP3
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Quarkus 3.27.4.SP3
  • Red Hat build of Quarkus 3.33.2.SP3
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16308
  2. 2026-10-03 Alias added: GHSA-g8rv-gp9f-q875
  3. 2026-10-09 Fix available: RHSA-2026:48118 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
  5. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.2.SP3 · Red Hat
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  9. 2026-11-03 Affected versions changed · Red Hat

References

Patch 1

  • TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-23774 IBM Aspera Faspex code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-03794 Improper authentication in IBM Data Risk Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03441 Code injection in IBM Planning Analytics KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-06198 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT… KEVCVSS 3.1CRITICAL 9.8
See all 9711 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences