Red Hat Product Errata RHSA-2026:83520 - Security Advisory
Issued:
2026-10-15
Updated:
2026-10-15

RHSA-2026:83520 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.33.4 release and security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.

Description

This release of Red Hat build of Quarkus 3.33.4 includes the following CVE fixes:

  • jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [quarkus-3.33] (CVE-2026-91777)
  • jackson-databind: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase [quarkus-3.33] (CVE-2026-91776)
  • jackson-databind: jackson-databind: Path traversal via incomplete type validation [quarkus-3.33] (CVE-2026-83557)
  • jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [quarkus-3.33] (CVE-2026-19032)
  • jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [quarkus-3.33] (CVE-2026-89425)
  • jackson-core: Jackson-core: Denial of Service via regular expression backtracking [quarkus-3.33] (CVE-2026-89407)
  • hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS) [quarkus-3.33] (CVE-2026-93879)
  • mongodb-crypt: MongoDB Java Driver: Denial of Service via use-after-free in client-side encryption cancellation [quarkus-3.33] (CVE-2026-88032)
  • quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache [quarkus-3.33] (CVE-2026-94451)
  • quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service [quarkus-3.33] (CVE-2026-94449)
  • freemarker: Apache FreeMarker: Path traversal via malformed locale identifier [quarkus-3.33] (CVE-2026-84939)
  • qute-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus [quarkus-3.33] (CVE-2026-93432)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [quarkus-3.33] (CVE-2026-89058)
  • mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs [quarkus-3.33] (CVE-2026-88033)
  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [quarkus-3.33] (CVE-2026-89059)
  • jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [quarkus-3.33] (CVE-2026-68497)
  • quarkus-hibernate-orm-rest-data-panache: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations [quarkus-3.33] (CVE-2026-87744)
  • lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations [quarkus-3.33] (CVE-2026-59949)
  • micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures [quarkus-3.33] (CVE-2026-59295)
  • micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [quarkus-3.33] (CVE-2026-59296)
  • bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [quarkus-3.33] (CVE-2026-71889)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

  • QUARKUS-8256 - RabbitMQ devservices do not share the same broker if multiple `mvn quarkus:dev` instances are started
  • QUARKUS-9478 - [3.33] Spring data fails to search by field
  • QUARKUS-9495 - [3.33] Quarkus TLS fails with illegal country code attribute
  • QUARKUS-9382 - Pass String array arguments of the invoked secured method to @PermissionChecker
  • QUARKUS-9381 - Skip Hibernate dev integrator in remote server-side dev mode
  • QUARKUS-9380 - Run writer interceptors for responses mapped from exceptions thrown before the interceptor handler
  • QUARKUS-9379 - Fix resolving sibling URL in JarResource
  • QUARKUS-9378 - Manage zstd-jni in the bom
  • QUARKUS-9377 - Bump zstd-jni to 1.5.7-16
  • QUARKUS-9376 - Document method-level OIDC REST client annotations
  • QUARKUS-9375 - Overwrite content-type header provided via the variant of the entity
  • QUARKUS-9374 - Make `@ServerExceptionMapper` in sub-resource specific to that sub-resource
  • QUARKUS-9373 - Harden remote dev mode against path traversal and unsafe deserialization
  • QUARKUS-9372 - Fix bad link syntax and update cross-document references to use xref
  • QUARKUS-9371 - Fix native image build failure caused by Netty's SelfSignedCertificate
  • QUARKUS-9370 - [3.33] Bump Micrometer to 1.16.7
  • QUARKUS-9369 - [3.33] Bump sshd to 2.19.0
  • QUARKUS-9368 - Send `@MatrixParam` and `@RestMatrix` from the REST Client
  • QUARKUS-9367 - Fix Gradle compilation against code generated by custom providers
  • QUARKUS-9366 - Pre-init Maven resolver HTTP transport classes to avoid class loading deadlock
  • QUARKUS-9365 - [3.33] Fix reading headers in Spring Web - Quarkus REST
  • QUARKUS-9364 - [3.33] Use composite key for token introspection and userinfo cache
  • QUARKUS-9363 - [3.33] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
  • QUARKUS-9362 - [3.33] Upgrade SmallRye GraphQL to 2.17.1
  • QUARKUS-9361 - [3.33] ArC: fix client proxy name collision for producers
  • QUARKUS-9360 - [3.33] Manage projectreactor in the bom, update to 3.8.7
  • QUARKUS-9359 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
  • QUARKUS-9358 - Add missing include::_attributes.adoc[] to init-tasks and build-analytics guides
  • QUARKUS-9357 - Fix typo sytem -> system in the dev services databases guide
  • QUARKUS-9356 - Bump org.jsoup:jsoup from 1.23.1 to 1.23.2
  • QUARKUS-9355 - Bump the time-out to 4 minutes for NativeImageBundleIT
  • QUARKUS-9354 - Remove blank line which breaks adoc header
  • QUARKUS-9353 - [3.33] Enforce managed versions on direct dependencies of an application artifact provided as a JAR
  • QUARKUS-9352 - [3.33] Use read-only ZIP FileSystem implementation to workaround for JDK-8316882
  • QUARKUS-9351 - [3.33] Explicit update to Netty 4.1.138.Final
  • QUARKUS-9350 - [3.33] Manage httpclient5 and httpcore5 in the bom
  • QUARKUS-9349 - [3.33] Bump Log4j to 2.25.5
  • QUARKUS-9348 - [3.33] Remove the CI job that runs k8s tests on Windows
  • QUARKUS-9347 - [3.33] Bump to Vert.x 4.5.34
  • QUARKUS-9346 - [3.33] SBOM cpe attribution
  • QUARKUS-9345 - [3.33] Bump Jackson to 2.21.6
  • QUARKUS-9344 - Bump the default GraphQL query depth limit to 20
  • QUARKUS-9343 - Updates to Infinispan 16.0.15
  • QUARKUS-9342 - [3.33] Qute: EvalSectionHelper and StrEvalNamespaceResolver fixes
  • QUARKUS-9341 - [3.33] Fix path normalization bypass on wildcard routes (matrix-param + dot-segment)
  • QUARKUS-9340 - [3.33] WebSockets Next: add max-pending-messages back-pressure
  • QUARKUS-9339 - [3.33] Upgrade to Hibernate 7.2.25.Final
  • QUARKUS-9338 - [3.33] : Bump smallrye-jwt version to 4.6.4
  • QUARKUS-9337 - [3.33] Upgrade to Elytron 2.8.5.Final
  • QUARKUS-9336 - [3.33] SmallRye Fault Tolerance: bump to 6.10.2
  • QUARKUS-9335 - [3.33] Bump freemarker to 2.3.35
  • QUARKUS-9334 - [3.33] Upgrade RESTEasy to 6.2.19.Final
  • QUARKUS-9333 - [3.33] Bump to BouncyCastle 1.86.1
  • QUARKUS-9332 - [3.33] Bump jackson to 2.21.7
  • QUARKUS-9331 - [3.33] Upgrade RESTEasy to 6.2.18.Final
  • QUARKUS-9330 - [3.33] Backport doc categorization work
  • QUARKUS-9329 - [3.33] Bump the hibernate group with 9 updates
  • QUARKUS-9328 - [3.33] Upgrade bouncycastle version to 1.85.2
  • QUARKUS-9327 - Some JSoup-related cleanup
  • QUARKUS-9326 - Update sync script to handle Qute site
  • QUARKUS-9325 - Confine Dev UI workspace JSON-RPC operations to the project root
  • QUARKUS-9324 - OIDC GraphQL client: fix NPE when default OIDC client is configured and native mode
  • QUARKUS-9323 - Bump at.yawk.lz4:lz4-java from 1.10.1 to 1.11.1 in /bom/application
  • QUARKUS-9322 - Fix EnumMap ClassCastException in bytecode recorder on method split
  • QUARKUS-9321 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
  • QUARKUS-9320 - Bump org.jsoup:jsoup from 1.15.3 to 1.23.1 in /core/processor
  • QUARKUS-9319 - Manage jsoup version in the bom
  • QUARKUS-9318 - Fix cross-application Dev Services discovery in ContainerLocator
  • QUARKUS-9317 - Do not miss Throwable in the OIDC code flow error log
  • QUARKUS-7966 - [3.33] Default gradle project created with Quarkus CLI 3.33 clashing between productized and unproductized io.netty:netty-transport-native-unix-common

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.