Red Hat Product Errata RHSA-2026:83082 - Security Advisory
Issued:
2026-10-15
Updated:
2026-10-15

RHSA-2026:83082 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.27.6 release and security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.27.6 includes the following CVE fixes:

  • jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [quarkus-3.27] (CVE-2026-91777)
  • jackson-databind: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase [quarkus-3.27] (CVE-2026-91776)
  • jackson-databind: jackson-databind: Path traversal via incomplete type validation [quarkus-3.27] (CVE-2026-83557)
  • jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [quarkus-3.27] (CVE-2026-19032)
  • jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [quarkus-3.27] (CVE-2026-89425)
  • jackson-core: Jackson-core: Denial of Service via regular expression backtracking [quarkus-3.27] (CVE-2026-89407)
  • hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS) [quarkus-3.27] (CVE-2026-93879)
  • mongodb-crypt: MongoDB Java Driver: Denial of Service via use-after-free in client-side encryption cancellation [quarkus-3.27] (CVE-2026-88032)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [quarkus-3.27] (CVE-2026-89058)
  • quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache [quarkus-3.27] (CVE-2026-94451)
  • quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service [quarkus-3.27] (CVE-2026-94449)
  • freemarker: Apache FreeMarker: Path traversal via malformed locale identifier [quarkus-3.27] (CVE-2026-84939)
  • qute-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus [quarkus-3.27] (CVE-2026-93432)
  • mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs [quarkus-3.27] (CVE-2026-88033)
  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [quarkus-3.27] (CVE-2026-89059)
  • jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [quarkus-3.27] (CVE-2026-68497)
  • quarkus-hibernate-orm-rest-data-panache: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations [quarkus-3.27] (CVE-2026-87744)
  • mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch [quarkus-3.27] (CVE-2026-55858)
  • mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication [quarkus-3.27] (CVE-2026-55857)
  • mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake [quarkus-3.27] (CVE-2026-55856)
  • lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations [quarkus-3.27] (CVE-2026-59949)
  • micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures [quarkus-3.27] (CVE-2026-59295)
  • micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [quarkus-3.27] (CVE-2026-59296)
  • bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [quarkus-3.27] (CVE-2026-71889)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For information about how to apply this update, see https://access.redhat.com/articles/11258.

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

  • QUARKUS-9388 - [3.27] Bump org.postgresql:postgresql from 42.7.11 to 42.7.13
  • QUARKUS-9389 - Bump keycloak to 26.4.0 and keycloak-client to 26.0.7
  • QUARKUS-9390 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
  • QUARKUS-9391 - Bump org.jsoup:jsoup from 1.15.3 to 1.23.1 in /core/processor
  • QUARKUS-9392 - [3.27] Bump sshd to 2.19.0
  • QUARKUS-9393 - [3.27] Bump the hibernate group with 7 updates
  • QUARKUS-9394 - Bump at.yawk.lz4:lz4-java from 1.10.1 to 1.11.1 in /bom/application
  • QUARKUS-9395 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.6 to 3.5.7
  • QUARKUS-9396 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.7 to 3.5.8
  • QUARKUS-9397 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.8 to 3.5.9
  • QUARKUS-9398 - [3.27] Upgrade RESTEasy to 6.2.18.Final
  • QUARKUS-9399 - [3.27] Upgrade SmallRye GraphQL to 2.14.3
  • QUARKUS-9400 - Add missing include::_attributes.adoc[] to init-tasks and build-analytics guides
  • QUARKUS-9401 - [3.27] Fix reading headers in Spring Web - Quarkus REST
  • QUARKUS-9402 - [3.27] Set a default GraphQL query depth limit of 10 to prevent DoS
  • QUARKUS-9403 - [3.27] Use composite key for token introspection and userinfo cache
  • QUARKUS-9404 - [3.27] Manage projectreactor in the bom, update to 3.8.7
  • QUARKUS-9405 - [3.27] Upgrade bouncycastle version to 1.85
  • QUARKUS-9406 - [3.27] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
  • QUARKUS-9407 - [3.27] Bump to Vert.x 4.5.34
  • QUARKUS-9408 - Bump org.jsoup:jsoup from 1.23.1 to 1.23.2
  • QUARKUS-9409 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
  • QUARKUS-9410 - [3.27] Upgrade to Hibernate 7.1.36.Final
  • QUARKUS-9411 - [3.27] : Bump smallrye-jwt version to 4.6.4
  • QUARKUS-9412 - [3.27] Upgrade to Elytron 2.6.10.SP1
  • QUARKUS-9413 - [3.27] Bump freemarker to 2.3.35
  • QUARKUS-9415 - [3.27] Upgrade RESTEasy to 6.2.19.Final
  • QUARKUS-9416 - Bump the default GraphQL query depth limit to 20
  • QUARKUS-9417 - [3.27] Bump Jackson to 2.21.6
  • QUARKUS-9418 - Bump zstd-jni to 1.5.7-16
  • QUARKUS-9419 - Manage zstd-jni in the bom
  • QUARKUS-9420 - [3.27] Upgrade to Keycloak 26.0.10
  • QUARKUS-9421 - [3.27] Explicit update to Netty 4.1.138.Final
  • QUARKUS-9422 - [3.27] SmallRye Fault Tolerance: bump to 6.9.4
  • QUARKUS-9423 - [3.27] Fix path normalization bypass on wildcard routes (matrix-param + dot-segment)
  • QUARKUS-9424 - [3.27] WebSockets Next: add max-pending-messages back-pressure
  • QUARKUS-9425 - [3.27] Bump Jackson to 2.21.7
  • QUARKUS-9426 - [3.27] Bump to BouncyCastle 1.86.1
  • QUARKUS-9427 - [3.27] Qute: EvalSectionHelper and StrEvalNamespaceResolver fixes
  • QUARKUS-9428 - Initialize org.keycloak.common.util.SecretGenerator at runtime for Keycloak admin client
  • QUARKUS-9429 - Fix bad link syntax and update cross-document references to use xref
  • QUARKUS-9430 - Harden remote dev mode against path traversal and unsafe deserialization
  • QUARKUS-9431 - Fix native image build failure caused by Netty's SelfSignedCertificate
  • QUARKUS-9432 - Manage jsoup version in the bom
  • QUARKUS-9433 - [3.27] Make some OIDC authentication failure messages more verbose
  • QUARKUS-9434 - [3.27] Backport changes related to raising level of some of OIDC log messages
  • QUARKUS-9435 - [3.27] Fix access log cookie masking to check all cookie pairs
  • QUARKUS-9436 - Confine Dev UI workspace JSON-RPC operations to the project root
  • QUARKUS-9437 - Update sync script to handle Qute site
  • QUARKUS-9450 - [3.27] Signed bouncycastle bcjmail-jdk18on jar in repo
  • QUARKUS-9480 - [3.27] BouncyCastle 1.85+ rejects country code "universe" in GenerateCACommand TLS CLI tests broken
  • QUARKUS-9490 - [3.27] Spring Data REST sorting returns HTTP 400 for valid entity fields

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.