Red Hat Product Errata RHSA-2026:95579 - Security Advisory
Issued:
2026-11-05
Updated:
2026-11-05

RHSA-2026:95579 - Security Advisory

Synopsis

Important: Red Hat build of Quarkus 3.27.6.SP3 release and security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for the vulnerability. For more information, see the CVE link in the References section.

Description

This release of Red Hat build of Quarkus 3.27.6.SP3 includes the following CVE fixes:

  • snappy-java: snappy-java: Denial of Service via out-of-bounds write [quarkus-3.27] (CVE-2026-90559)
  • snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress [quarkus-3.27] (CVE-2026-93452)
  • quarkus-vertx-http: quarkus-vertx-http: Authorization bypass in management interface via path concatenation flaw [quarkus-3.27] (CVE-2026-107912)
  • snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression [quarkus-3.27] (CVE-2026-108106)
  • lz4-java: lz4-java: Denial of Service via excessive memory allocation from crafted compressed streams [quarkus-3.27] (CVE-2026-106450)
  • lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling [quarkus-3.27] (CVE-2026-106451)
  • lz4-java: lz4-java: Denial of Service via excessive memory allocation [quarkus-3.27] (CVE-2026-106452)
  • lz4-java: lz4-java: Denial of Service via untrusted decompressed length header [quarkus-3.27] (CVE-2026-106453)
  • guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [quarkus-3.27] (CVE-2026-102554)
  • vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure [quarkus-3.27] (CVE-2026-102460)
  • vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb [quarkus-3.27] (CVE-2026-102477)
  • snappy-java: snappy-java: information disclosure via double release of pooled buffers [quarkus-3.27] (CVE-2026-108104)
  • mysql-connector-j: Connector/J unspecified vulnerability (CPU Apr 2025) [quarkus-3.27] (CVE-2025-30706)
  • mysql-connector-j: MySQL Connectors: Information Disclosure via Network Access [quarkus-3.27] (CVE-2026-60586)
  • mysql-connector-j: MySQL Connector/J: Data Compromise and Partial Service Interruption [quarkus-3.27] (CVE-2026-60623)
  • mysql-connector-j: MySQL Connector/J: Denial of Service via unauthenticated network access with user interaction [quarkus-3.27] (CVE-2026-60624)
  • mysql-connector-j: MySQL Connector/J: Information disclosure vulnerability [quarkus-3.27] (CVE-2026-61082)
  • snappy-java: snappy-java: Buffer overflow via malformed compressed input [quarkus-3.27] (CVE-2026-93451)
  • snappy-java: snappy-java: Denial of Service via out-of-bounds memory access [quarkus-3.27] (CVE-2026-116590)

For more information, see the release notes page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat build of Quarkus Text-Only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.