IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

quarkus vulnerabilities (CVE)

CVE records published for quarkus, newest first. Follow to get an email when a new one appears.

3.27 463.33 383.20 8quarkus 7quarkus-qute 1
52 results
9.1Critical
CVE-2026-87744

Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat; Red Hat Exploit Intelligence

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring sec…

6.5Medium
CVE-2026-94451

Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat; Red Hat Exploit Intelligence

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they sh…

7.5High
CVE-2026-94449

Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

Red Hat Red Hat Build of Apache Camel 3.33.4.redhat; Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat; Red Hat Exploit Intelligence

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fail…

1.1%EPSS
6.5Medium
CVE-2026-93562

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, po…

6.5Medium
CVE-2026-93574

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTT…

1.7%EPSS
6.1Medium
CVE-2026-93432

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Red Hat Red Hat Build of Apache Camel 3.33.4.redhat; Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat; Red Hat Exploit Intelligence

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output a…

1.2%EPSS
6.5Medium
CVE-2026-93579

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP…

1.1%EPSS
6.5Medium
CVE-2026-93573

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer c…

1.1%EPSS
7.5High
CVE-2026-93568

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT request…

1.1%EPSS
8.2High
CVE-2026-93569

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prio…

2.4%EPSS
7.5High
CVE-2026-93567

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by su…

2.9%EPSS
6.5Medium
CVE-2026-93566

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HT…

7.5High
CVE-2026-93565

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP re…

7.5High
CVE-2026-93564

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS)…

1.1%EPSS
7.5High
CVE-2026-93558

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-co…

1.2%EPSS
5.3Medium
CVE-2026-93492

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17; Red Hat Red Hat build of Keycloak 26.6

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CP…

7.5High
CVE-2026-93491

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, lead…

7.5High
CVE-2026-93488

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connectio…

7.5High
CVE-2026-87743

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Red Hat OpenShift Dev Spaces 3.31; Red Hat Exploit Intelligence

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers…

7.4High
CVE-2026-89058

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Red Hat RESTEasy; Red Hat Red Hat Build of Apache Camel 3.33.4.redhat; Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-ori…

7.5High
CVE-2026-89059

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Red Hat RESTEasy; Red Hat Red Hat Build of Apache Camel 3.33.4.redhat; Red Hat Red Hat build of Quarkus 3.27.6.redhat; Red Hat Red Hat build of Quarkus 3.33.4.redhat

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enor…

1.5%EPSS
7.5High
CVE-2026-87742

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Exploit Intelligence; Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a l…

5.3Medium
CVE-2026-81829

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Exploit Intelligence; Red Hat Red Hat build of Apicurio Registry 3

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concaten…

8.8High
CVE-2026-12894

Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

Quarkus quarkus-qute; Red Hat Red Hat Build of Apache Camel 3.33.3.SP1; Red Hat Red Hat build of Quarkus 3.27.5.SP1; Red Hat Red Hat build of Quarkus 3.33.3.SP1

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block acc…

7.4High
CVE-2026-19611

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Red Hat Red Hat Build of Apache Camel 3.33.3.SP2; Red Hat Red Hat Build of Debezium 3.6; Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.17

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionar…

1.0%EPSS