Red Hat Product Errata RHSA-2026:95289 - Security Advisory
Issued:
2026-11-05
Updated:
2026-11-05

RHSA-2026:95289 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.33.4.SP3 release and security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for the vulnerability. For more information, see the CVE link in the References section.

Description

This release of Red Hat build of Quarkus 3.33.4.SP3 includes the following CVE fixes:

  • guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [quarkus-3.33] (CVE-2026-102554)
  • lz4-java: lz4-java: Denial of Service via excessive memory allocation from crafted compressed streams [quarkus-3.33] (CVE-2026-106450)
  • lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling [quarkus-3.33] (CVE-2026-106451)
  • lz4-java: lz4-java: Denial of Service via excessive memory allocation [quarkus-3.33] (CVE-2026-106452)
  • lz4-java: lz4-java: Denial of Service via untrusted decompressed length header [quarkus-3.33] (CVE-2026-106453)
  • mysql-connector-j: MySQL Connectors: Information Disclosure via Network Access [quarkus-3.33] (CVE-2026-60586)
  • mysql-connector-j: MySQL Connector/J: Data Compromise and Partial Service Interruption [quarkus-3.33] (CVE-2026-60623)
  • mysql-connector-j: MySQL Connector/J: Denial of Service via unauthenticated network access with user interaction [quarkus-3.33] (CVE-2026-60624)
  • mysql-connector-j: MySQL Connector/J: Information disclosure vulnerability [quarkus-3.33] (CVE-2026-61082)
  • mysql-connector-j: Connector/J unspecified vulnerability (CPU Apr 2025) [quarkus-3.33] (CVE-2025-30706)
  • snappy-java: snappy-java: Denial of Service via out-of-bounds write [quarkus-3.33] (CVE-2026-90559)
  • snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress [quarkus-3.33] (CVE-2026-93452)
  • snappy-java: snappy-java: Buffer overflow via malformed compressed input [quarkus-3.33] (CVE-2026-93451)
  • snappy-java: snappy-java: Denial of Service via out-of-bounds memory access [quarkus-3.33] (CVE-2026-116590)
  • quarkus-vertx-http: quarkus-vertx-http: Authorization bypass in management interface via path concatenation flaw [quarkus-3.33] (CVE-2026-107912)
  • snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression [quarkus-3.33] (CVE-2026-108106)
  • snappy-java: snappy-java: information disclosure via double release of pooled buffers [quarkus-3.33] (CVE-2026-108104)
  • vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb [quarkus-3.33] (CVE-2026-102477)
  • vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure [quarkus-3.33] (CVE-2026-102460)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.