Red Hat Product Errata RHSA-2026:36002 - Security Advisory
Issued:
2026-07-08
Updated:
2026-07-08

RHSA-2026:36002 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.27.4.SP2 security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.27.4.SP2 includes the following CVE fixes:

  • micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [quarkus-3.27] (CVE-2026-40984)
  • jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [quarkus-3.27] (CVE-2026-54512)
  • jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application [quarkus-3.27] (CVE-2026-54517)
  • jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass [quarkus-3.27] (CVE-2026-54518)
  • jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution [quarkus-3.27] (CVE-2026-54514)
  • jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [quarkus-3.27] (CVE-2026-54515)
  • jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties [quarkus-3.27] (CVE-2026-54516)
  • jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [quarkus-3.27] (CVE-2026-54513)
  • keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison [quarkus-3.27] (CVE-2026-9800)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

  • QUARKUS-8308 - [3.27.4.SP2] Align to productized 26.0.10 Keycloak

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.