RHSA-2026:24502 - Security Advisory

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes:

• netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578)
• netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581)
• netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584)
• netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587)
• netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

• QUARKUS-7634 - Enforce plexus-utils 3.6.1 to fix CVE-2025-67030
• QUARKUS-7635 - Remove duplicated `plexus-utils` from bootstrap BOM
• QUARKUS-7636 - [3.33] Upgrade to Vert.x 4.5.26 and Netty 4.1.132.Final
• QUARKUS-7637 - [3.33] Bump Hibernate ORM to 7.2.9.Final, Reactive to 3.2.9.Final
• QUARKUS-7638 - Style and grammar review for the OpenID Connect authorization code flow
• QUARKUS-7639 - Style and grammar review for the "OpenID Connect (OIDC) and OAuth2 client and filters" guide
• QUARKUS-7640 - Updates to Infinispan 16.0.9
• QUARKUS-7641 - Webauthn IT: move test-webauthn to the test scope
• QUARKUS-7642 - Also populate cache on GitHub Actions for main repo
• QUARKUS-7643 - Set up CodeQL security analysis for pull requests
• QUARKUS-7644 - Fix Oracle connection rollback interceptor
• QUARKUS-7645 - Fix xref link text in security-authentication-mechanisms.adoc
• QUARKUS-7646 - Docs: Add caution note to Using RestResponse section in rest-client.adoc
• QUARKUS-7647 - [3.33] Update to plexus-utils 3.6.1
• QUARKUS-7648 - [3.34] Update SmallRye Fault Tolerance to 6.10.1
• QUARKUS-7649 - Update Gradle template to select `quarkus-junit` or `quarkus-junit5` based on Quarkus platform version
• QUARKUS-7650 - Some minor uberjar improvements and a test for service concatenation
• QUARKUS-7651 - Prevent warning about Gauge having already been registered
• QUARKUS-7652 - OpenAPI: Detect repeated @PermissionsAllowed annotations in Swagger UI
• QUARKUS-7653 - JFR extension event fix
• QUARKUS-7654 - Honour the legacy resolver settings in go-offline goals
• QUARKUS-7655 - Refactor jar building to a first-write-wins approach
• QUARKUS-7656 - OpenShift Internal Registry Container Image Name
• QUARKUS-7657 - [3.33] documentation backports
• QUARKUS-7658 - Little asciidoc markup fix for the OIDC authentication guide
• QUARKUS-7659 - Use getRecommended() when displaying platforms to be imported in quarkus info command
• QUARKUS-7660 - Register `oracle.jdbc.OracleDriver` for reflection
• QUARKUS-7661 - Tightening workflow permissions
• QUARKUS-7666 - Elicitation and sampling fail in native mode
• QUARKUS-7686 - In 3.33 the kafka-streams-test-utils is unaligned with productized kafka-streams
• QUARKUS-7727 - Properly set path property for `quarkus-artifact.properties`
• QUARKUS-7728 - Fix `@ServerExceptionMapper` handling for generic types
• QUARKUS-7729 - Avoid skipping config tracking when the Quarkus build is skipped
• QUARKUS-7730 - Do not preinit UUID infrastructure for Vert.x anymore
• QUARKUS-7731 - Ensure that shared Config build time runtime fixed uses the expected profile when set from @TestProfile
• QUARKUS-7732 - Avoid trying to parse null URI
• QUARKUS-7733 - Fix typo in unused gRPC interceptor warnings
• QUARKUS-7734 - Move `OracleDatabaseTypeSubstitution` to `flyway-oracle`
• QUARKUS-7735 - List commands when you run `just`
• QUARKUS-7736 - Fix spelling error in Dev UI Docs screenshot
• QUARKUS-7737 - Use `<annotationProcessorPathsUseDepMgmt>` in new extension projects
• QUARKUS-7738 - Bump wildfly-elytron.version from 2.8.3.Final to 2.8.4.Final
• QUARKUS-7739 - Bump Keycloak version to 25.6.7
• QUARKUS-7740 - build(deps): bump testcontainers.version from 2.0.3 to 2.0.4
• QUARKUS-7741 - Review for the OpenID Connect client and token propagation quickstart
• QUARKUS-7742 - Bump bouncycastle to 1.84
• QUARKUS-7743 - Bump SmallRye Certificate Generator to 0.9.2
• QUARKUS-7744 - Bump webauthn4j.version from 0.28.0.RELEASE to 0.30.3.RELEASE
• QUARKUS-7745 - Fix JvmOption JSON serialization
• QUARKUS-7746 - OIDC code flow docs: fix incorrectly named PKCE state secret property
• QUARKUS-7747 - Avoid adding duplicate META-INF/ directories
• QUARKUS-7748 - Review for the "Deploying Quarkus applications to OpenShift" guide
• QUARKUS-7749 - Make some OIDC authentication failure messages more verbose
• QUARKUS-7750 - Remove the tech preview note from reactive-sql-clients.adoc
• QUARKUS-7751 - Fix infinite loop in `AeshConsole.deadlockSafeWrite()` during dev mode shutdown
• QUARKUS-7752 - Fix typo in Grafana dashboard title
• QUARKUS-7753 - Remove the org.lz4 exclusion, it's no longer necessary
• QUARKUS-7754 - Fixing two numbered procedures and their includes in OpenID Connect client and token propagation quickstart
• QUARKUS-7783 - [3.33] Move Kafka to 4.1.2
• QUARKUS-7784 - [3.33] Strip matrix parameters from request paths during HTTP security policy matching
• QUARKUS-7785 - [3.33] Quarkus REST: fix `@Context` injection for records
• QUARKUS-7786 - Fix Jakarta Transaction link on transaction.adoc documentation
• QUARKUS-7787 - Undeprecate REST Client connect timeout config
• QUARKUS-7788 - Bump to quarkus-http 5.5.0
• QUARKUS-7789 - Clarify X provider callback URI registration without Renarde-specific paths in the OIDC providers guide
• QUARKUS-7790 - Bump to Vert.x 4.5.27 and Netty 4.1.133.Final
• QUARKUS-7791 - Bump postgresql-jdbc.version to 42.7.11
• QUARKUS-7795 - Prevent server's OpenTelemetry Context getting lost on client read timeout
• QUARKUS-7796 - VertxHttpHotReplacementSetup: move the httpInitiatedReload flag check
• QUARKUS-7797 - [3.34] Quarkus REST: fix @Context injection for records
• QUARKUS-7798 - Avoid CCE when reloading Vert.x trust store
• QUARKUS-7799 - Update RESTEasy Classic to 6.2.16.Final
• QUARKUS-7810 - Bump the hibernate group across 1 directory with 9 updates
• QUARKUS-7811 - [3.33] Pin actions to specific shas, and avoid using external actions when we can
• QUARKUS-7843 - Upgrade Infinispan to 16.0.12 and Protostream to 6.0.7 for RHBQ 3.33.2
• QUARKUS-7863 - Bump postgresql-jdbc.version to 42.7.11

CVEs

• CVE-2026-42578
• CVE-2026-42579
• CVE-2026-42581
• CVE-2026-42584
• CVE-2026-42587

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/products/quarkus/
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.33.2
• https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33