Red Hat Product Errata RHSA-2026:47172 - Security Advisory
Issued:
2026-07-30
Updated:
2026-07-30

RHSA-2026:47172 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.33.2.SP3 security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.33.2.SP3 includes the following CVE fixes:

  • resteasy-reactive-client-processor: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service [quarkus-3.33] (CVE-2026-16308)
  • vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [quarkus-3.33] (CVE-2026-15075)
  • httpcore: org.apache.httpcomponents.core5:httpcore5: Denial of Service via excessive HTTP headers [quarkus-3.33] (CVE-2026-54399)
  • org.apache.httpcomponents.core5:httpcore5-h2:HPackDecoder Unlimited Header List Size Before SETTINGS ACK [quarkus-3.33] (CVE-2026-54428)
  • vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [quarkus-3.33] (CVE-2026-15076)
  • netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [quarkus-3.33] (CVE-2026-55833)
  • netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [quarkus-3.33] (CVE-2026-55831)
  • netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [quarkus-3.33] (CVE-2026-55851)
  • netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [quarkus-3.33] (CVE-2026-56745)
  • netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [quarkus-3.33] (CVE-2026-56746)
  • netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [quarkus-3.33] (CVE-2026-56819)
  • netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [quarkus-3.33] (CVE-2026-59899)
  • netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder [quarkus-3.33] (CVE-2026-59921)
  • netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 [quarkus-3.33] (CVE-2026-59900)
  • netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) [quarkus-3.33] (CVE-2026-59898)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.