RHSA-2026:7380 - Security Advisory

Sujet

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.27.3 includes the following CVE fixes:

• netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [quarkus-3.27] (CVE-2026-33871)
• netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [quarkus-3.27] (CVE-2026-33870)
• plexus-utils: Plexus-utils: Directory Traversal in extractFile method [quarkus-3.27] (CVE-2025-67030)
• avro: Apache Avro Java SDK: Code injection on Java generated code [quarkus-3.27] (CVE-2025-33042)
• vertx-core: static handler component cache can be manipulated to deny the access to static files [quarkus-3.27] (CVE-2026-1002)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Produits concernés

• Red Hat build of Quarkus Text-Only Advisories x86_64

Correctifs

• QUARKUS-5216 - quarkus-tls-registry should declare its CLI plugin as fatjar
• QUARKUS-6747 - Hierarchy visualisation in DEV UI Workspace is broken on Windows
• QUARKUS-6945 - MCP Server passes wrong values to tools when running on virtualised environemnts
• QUARKUS-6947 - Quarkus CLI doesn't output support scope for an offering
• QUARKUS-6953 - Quarkus CLI output extension versions for non-existing offering
• QUARKUS-6954 - Quarkus CLI includes productised Langcain4j even when the registry is marked with redhat offering
• QUARKUS-7125 - Empty source file Operator SDK
• QUARKUS-7130 - Caffeine @CacheResult fails to sychronize concurrent access when first Uni fails
• QUARKUS-7183 - [3.27] Prevent startup failing when having mismatched datasource types betwen Hibernate ORM (blocking)
• QUARKUS-7209 - Set Keycloak client web origins in the dev service
• QUARKUS-7210 - Fix issuer-based tenant resolution for a tenant issuer configured in OIDC tenant configuration rather than well-known configuration
• QUARKUS-7211 - Do not enforce request and absolute OIDC redirect-path match
• QUARKUS-7212 - Fix invalid JWT headers NPE during delayed JWK resolution
• QUARKUS-7213 - Fix two class loader-related leaks, one in Jackson, the other in QuarkusClassLoader
• QUARKUS-7214 - Update Base64 encoded credentials
• QUARKUS-7215 - Make sure application root paths are normalized and absolute when bootstrapping for tests
• QUARKUS-7216 - Fix handling of multiple PreExceptionMapperHandler
• QUARKUS-7219 - Log `InterruptedException` as `debug` for `RemoteSyncHandler`
• QUARKUS-7220 - Fix Rest Client logging documentation
• QUARKUS-7221 - Remove injection and passing around of TaskDependencyFactory
• QUARKUS-7222 - CI - Avoid go-offline logging
• QUARKUS-7223 - Bump to Vert.x 4.5.24
• QUARKUS-7224 - Better handling for null or empty authority
• QUARKUS-7225 - Replace deprecated `quarkus.log.file.enable` with `quarkus.log.file.enabled` in `QuarkusProdModeTest`
• QUARKUS-7226 - Generate enum description for lists and optional lists in Quarkus config documentation
• QUARKUS-7227 - Fix a scope double-encoding issue in KeycloakTestClient
• QUARKUS-7228 - Return failure for invalid basic authorization
• QUARKUS-7312 - Bump org.assertj:assertj-core from 3.27.4 to 3.27.5
• QUARKUS-7313 - Bump org.assertj:assertj-core from 3.27.4 to 3.27.5 in /devtools/gradle
• QUARKUS-7314 - Bump org.assertj:assertj-core from 3.27.5 to 3.27.6
• QUARKUS-7315 - Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 in /devtools/gradle
• QUARKUS-7316 - Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 in /devtools/gradle
• QUARKUS-7317 - Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 in /build-parent
• QUARKUS-7318 - Bump org.assertj:assertj-core from 3.27.6 to 3.27.7
• QUARKUS-7319 - Redis Client: fix NPE in optimistic locking transactions
• QUARKUS-7320 - Update RESTEasy HAL IETF URL
• QUARKUS-7321 - Bump to Vert.x 4.5.25
• QUARKUS-7348 - Ensure that annotations in Quarkus REST is never null
• QUARKUS-7349 - [3.27] registry client backports
• QUARKUS-7350 - Be more defensive about copying HTTP headers in tracing SPI
• QUARKUS-7351 - [3.27] build(deps): bump the hibernate group with 7 updates
• QUARKUS-7352 - [3.27] build(deps): bump the hibernate group with 7 updates
• QUARKUS-7378 - Quarkus REST - Ignore Vert.x Web packages for reflection
• QUARKUS-7491 - Upgrade Jackson to 2.21.2
• QUARKUS-7494 - Agroal and Jackson artifacts in 3.27.3 RHBQ platform BOM reference community versions without redhat suffix

CVE

• CVE-2025-33042
• CVE-2025-67030
• CVE-2026-1002
• CVE-2026-33870
• CVE-2026-33871

Références

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/products/quarkus/
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.27.3
• https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27