RHSA-2026:51653 - Security Advisory

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.33.3 includes the following CVE fixes:

• scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack [quarkus-3.33] (CVE-2026-53712)
• jansi: Jansi: Heap buffer overflow leads to Denial of Service [quarkus-3.33] (CVE-2026-8484)
• postgresql: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade [quarkus-3.33] (CVE-2026-54291)
• sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation [quarkus-3.33] (CVE-2026-56624)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

• QUARKUS-7792 - Unifing the code sample headers for the OpenShift guide
• QUARKUS-7793 - Mark UBI9_JAVA25 as containsJavaRun
• QUARKUS-7794 - Fix Connection: keep-alive being set on HTTP/2 responses in RESTEasy Classic
• QUARKUS-7800 - Fix Quarkus REST issue with duplicate coroutine invokers
• QUARKUS-7871 - [3.33.2 regression] OpenAPI build failure: Index does not contain the annotation definition: PermissionsAllowed
• QUARKUS-8062 - [3.33] Bump postgresql-jdbc.version to 42.7.11
• QUARKUS-8064 - [3.33] Bump the hibernate group with 9 updates
• QUARKUS-8065 - [3.33] Some lost backports
• QUARKUS-8066 - [3.33] Updates to Infinispan 16.0.12.Final
• QUARKUS-8067 - Filter out package names before proxy generation to fix spurious warning
• QUARKUS-8068 - [3.33] Harden OIDC debug logs
• QUARKUS-8069 - Cleanup temp files even when Jakarta REST Interceptors exist
• QUARKUS-8070 - Upgrade gRPC to 1.81.0, fix substitutions
• QUARKUS-8071 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.7 to 3.5.8
• QUARKUS-8072 - Update JAXB to 4.0.8
• QUARKUS-8073 - Bump to Vert.x 4.5.28 and Netty 4.1.135.Final
• QUARKUS-8074 - Fix dead links in dev-ui.adoc
• QUARKUS-8075 - Fix dead micrometer.io links in telemetry-micrometer.adoc
• QUARKUS-8076 - Fix broken GitHub links across several guides
• QUARKUS-8077 - Drop trailing slash that causes a 404
• QUARKUS-8078 - Fix dead links in REST guides
• QUARKUS-8079 - Prevent NPE in mTLS auth mech when communication with a trusted proxy happens over HTTP protocol but headers indicate HTTPS
• QUARKUS-8080 - Use Quarkus Gauge builder
• QUARKUS-8081 - docs: replace Markdown xml fence with AsciiDoc source block
• QUARKUS-8082 - Fix Liquibase native resolution when included changelogs use logicalFilePath
• QUARKUS-8083 - Handle edge-case with kapt plugin missing generated sources
• QUARKUS-8084 - Fix Azure-functions: update default ExtensionBundle to [4.0.0, 5.0.0)
• QUARKUS-8085 - Fix potential NPE and warn if trustall is being used in the exporter
• QUARKUS-8086 - Use proper CL when running Google Cloud Functions
• QUARKUS-8087 - Fix `QuarkusEntryPoint` path decoding issue
• QUARKUS-8088 - Add CLAUDE.local.md to .gitignore
• QUARKUS-8089 - OpenAPI build failure with mp.openapi.scan.packages
• QUARKUS-8233 - Call reusable workflow for Quarkus Ecosystem CI
• QUARKUS-8234 - Add condition to Quarkiverse ecosystem CI workflow
• QUARKUS-8235 - Prometheus compression header fix
• QUARKUS-8236 - Fix NPE in RemoteUserAttribute with anonymous identity
• QUARKUS-8237 - Fix Hibernate ORM Dev UI localization and clear HQL input on submit
• QUARKUS-8238 - Updates to Infinispan 16.0.12.Final
• QUARKUS-8239 - Fix `@ServerExceptionMapper` bridge method handling for generic types
• QUARKUS-8240 - Fix dead links in security guides
• QUARKUS-8241 - Fix dead links in kafka.adoc
• QUARKUS-8242 - Bump io.quarkus:quarkus-fs-util from 1.4.0 to 1.4.2
• QUARKUS-8243 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.8 to 3.5.9
• QUARKUS-8244 - Fix Javadoc of `ClientRedirectHandler`
• QUARKUS-8245 - Updates Infinispan to 16.0.13
• QUARKUS-8246 - Document Basic authentication realm compatibility
• QUARKUS-8247 - Fix null Vert.x log messages showing as NULL in native mode
• QUARKUS-8248 - Add cyclone configuration to docs
• QUARKUS-8249 - Do not bytecode record the Vert.x service instances
• QUARKUS-8250 - Disambiguate config doc anchors for build-time properties
• QUARKUS-8251 - Avoid transfer progress in Quarkus Update commands
• QUARKUS-8252 - Fix wrong description for agroal.invalid.count metric
• QUARKUS-8253 - Properly support `java.lang.Record` as Lambda return type
• QUARKUS-8254 - Update documentation of `ReflectiveClassConditionBuildItem`
• QUARKUS-8255 - Wrap shorthand admonition blocks in ==== delimiters
• QUARKUS-8309 - [3.33] Make MultiRootPathTree.apply() consistent with accept()
• QUARKUS-8310 - Fix "Kafka OAuthBearer authentication fails in native mode" again
• QUARKUS-8311 - [3.33] Update to MicroProfile API 3.1.1
• QUARKUS-8312 - Gradle plugin: declare jandex task ordering for all tasks consuming main source set resources
• QUARKUS-8313 - Add UnwrappedTypeResolverBuilder reflective class registration to kubernetes-client
• QUARKUS-8314 - Treat empty registry offering as unset
• QUARKUS-8315 - [3.33] Bump jackson to 2.21.4
• QUARKUS-8316 - [3.33] Upgrade to Keycloak 26.0.10
• QUARKUS-8317 - [3.33] Upgrade micrometer to 1.16.6
• QUARKUS-8318 - [3.33] Switch from org.fusesource.jansi to org.jline:jansi
• QUARKUS-8416 - Bump org.postgresql:postgresql from 42.7.11 to 42.7.13
• QUARKUS-8417 - Bump com.ongres.scram:scram-client from 3.2 to 3.3 in /bom/application
• QUARKUS-8418 - Change log level of some OIDC log messages from debug to warn
• QUARKUS-8419 - Allow the use of `@Cancellable` on `ContainerResponseFilter`
• QUARKUS-8420 - Quarkus REST: fix response status for sub-resource requests with a malformed content type
• QUARKUS-8421 - Enforce no duplicate POM dependencies via maven-enforcer-plugin
• QUARKUS-8422 - Reduce allocation in HTTP instrumentation
• QUARKUS-8423 - Fix performance regression in AotQuarkusEntryPoint
• QUARKUS-8424 - Don't ignore `Future` in Smallrye Health
• QUARKUS-8425 - Fix memory leak in REST Client reactive pipelines
• QUARKUS-8426 - Don't use `ordered` execution for `@RunOnVertxContext`
• QUARKUS-8427 - Apply DevUI CORS and Host checks to DevMCP
• QUARKUS-8428 - Set a default GraphQL query depth limit of 10
• QUARKUS-8543 - [3.33] Fix native image regression caused by Netty 4.1.136 SslContext API change
• QUARKUS-8572 - Use the officially supported and productized version of Infinispan offered by RHDG team

CVEs

• CVE-2026-8484
• CVE-2026-53712
• CVE-2026-54291
• CVE-2026-56624
• CVE-2026-68494

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/products/quarkus/
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.33.3
• https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33