Red Hat Product Errata RHSA-2026:69470 - Security Advisory
Issued:
2026-09-21
Updated:
2026-09-21

RHSA-2026:69470 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.27.5.SP2 release and security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.27.5.SP2 includes the following CVE fixes:

  • hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [quarkus-3.27] (CVE-2026-77874)
  • jsoup: Cross-site scripting flaw requires a custom Safelist that explicitly allows raw-text elements [quarkus-3.27] (CVE-2026-71497)
  • wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [quarkus-3.27] (CVE-2026-19611)
  • quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver [quarkus-3.27] (CVE-2026-81829)
  • reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure [quarkus-3.27] (CVE-2026-47857)
  • reactor-core: Reactor Core: Denial of Service in bufferTimeout operator [quarkus-3.27] (CVE-2026-47863)
  • quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering [quarkus-3.27] (CVE-2026-87742)
  • quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security [quarkus-3.27] (CVE-2026-87743)
  • zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [quarkus-3.27] (CVE-2026-87825)
  • zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [quarkus-3.27] (CVE-2026-87877)
  • zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [quarkus-3.27] (CVE-2026-87795)
  • zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [quarkus-3.27] (CVE-2026-87824)
  • zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [quarkus-3.27] (CVE-2026-89046)
  • zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [quarkus-3.27] (CVE-2026-90560)
  • bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [quarkus-3.27] (CVE-2026-58059)
  • bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [quarkus-3.27] (CVE-2026-12860)
  • zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [quarkus-3.27] (CVE-2026-90852)
  • zstd-jni: zstd-jni: Denial of Service via negative length parameter [quarkus-3.27] (CVE-2026-89045)
  • zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read [quarkus-3.27] (CVE-2026-87823)
  • netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [quarkus-3.27] (CVE-2026-93488)
  • netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [quarkus-3.27] (CVE-2026-93491)
  • netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [quarkus-3.27] (CVE-2026-93558)
  • netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) [quarkus-3.27] (CVE-2026-93564)
  • netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [quarkus-3.27] (CVE-2026-93565)
  • netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [quarkus-3.27] (CVE-2026-93567)
  • netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [quarkus-3.27] (CVE-2026-93568)
  • netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [quarkus-3.27] (CVE-2026-93569)
  • netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [quarkus-3.27] (CVE-2026-93492)
  • netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [quarkus-3.27] (CVE-2026-93562)
  • netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [quarkus-3.27] (CVE-2026-93566)
  • netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [quarkus-3.27] (CVE-2026-93573)
  • netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [quarkus-3.27] (CVE-2026-93574)
  • netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [quarkus-3.27] (CVE-2026-93579)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

  • QUARKUS-8740 - CVE-2026-71497 jsoup: Cross-site scripting flaw requires a custom Safelist that explicitly allows raw-text elements [quarkus-3.27]

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.