quarkusio güvenlik açıkları (CVE)

quarkusio için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

4 sonuç

7.5Yüksek

CVE-2026-50559 4 ay önce

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Quarkus 3.20.6.SP2

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle ma…

1.0%EPSS

8.8Yüksek

CVE-2026-39852 6 ay önce

Quarkus authorization bypass via semicolon path normalization inconsistency

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or …

5.9Orta

CVE-2025-66560 10 ay önce

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

quarkusio quarkus

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, …

6.4Orta

CVE-2025-49574 1 yıl önce

Quarkus potential data leak when duplicating a duplicated context

quarkusio quarkus

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated c…