RHSA-2026:69470
Vulnerability from csaf_redhat - Published: 2026-09-21 16:19 - Updated: 2026-10-08 23:36Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP2 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.27.5.SP2 includes the following CVE fixes:
* hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [quarkus-3.27] (CVE-2026-77874)
* jsoup: Cross-site scripting flaw requires a custom Safelist that explicitly allows raw-text elements [quarkus-3.27] (CVE-2026-71497)
* wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [quarkus-3.27] (CVE-2026-19611)
* quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver [quarkus-3.27] (CVE-2026-81829)
* reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure [quarkus-3.27] (CVE-2026-47857)
* reactor-core: Reactor Core: Denial of Service in bufferTimeout operator [quarkus-3.27] (CVE-2026-47863)
* quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering [quarkus-3.27] (CVE-2026-87742)
* quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security [quarkus-3.27] (CVE-2026-87743)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [quarkus-3.27] (CVE-2026-87825)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [quarkus-3.27] (CVE-2026-87877)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [quarkus-3.27] (CVE-2026-87795)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [quarkus-3.27] (CVE-2026-87824)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [quarkus-3.27] (CVE-2026-89046)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [quarkus-3.27] (CVE-2026-90560)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [quarkus-3.27] (CVE-2026-58059)
* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [quarkus-3.27] (CVE-2026-12860)
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [quarkus-3.27] (CVE-2026-90852)
* zstd-jni: zstd-jni: Denial of Service via negative length parameter [quarkus-3.27] (CVE-2026-89045)
* zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read [quarkus-3.27] (CVE-2026-87823)
* netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [quarkus-3.27] (CVE-2026-93488)
* netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [quarkus-3.27] (CVE-2026-93491)
* netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [quarkus-3.27] (CVE-2026-93558)
* netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) [quarkus-3.27] (CVE-2026-93564)
* netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [quarkus-3.27] (CVE-2026-93565)
* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [quarkus-3.27] (CVE-2026-93567)
* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [quarkus-3.27] (CVE-2026-93568)
* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [quarkus-3.27] (CVE-2026-93569)
* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [quarkus-3.27] (CVE-2026-93492)
* netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [quarkus-3.27] (CVE-2026-93562)
* netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [quarkus-3.27] (CVE-2026-93566)
* netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [quarkus-3.27] (CVE-2026-93573)
* netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [quarkus-3.27] (CVE-2026-93574)
* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [quarkus-3.27] (CVE-2026-93579)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.5.SP2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service (DoS) condition. This could cause applications to become unresponsive or crash.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Reactor Core. Applications using the `Flux.bufferTimeout` operator with `fairBackpressure` enabled are vulnerable to a Denial of Service (DoS) condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang and making the application unresponsive.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in jsoup. A remote attacker could exploit an uncontrolled resource consumption vulnerability in the XmlTreeBuilder by providing a deeply nested XML document with uniquely-namespaced elements. This causes the builder to copy the entire inherited namespace map on every start element, leading to quadratic time and memory complexity. Successful exploitation could exhaust JVM heap memory, resulting in an OutOfMemoryError and terminating the application, effectively causing a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.
8.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability arises from insufficient bounds checks in direct-ByteBuffer frame-size native methods, which allows attackers to provide negative or overflowing offsets. A remote attacker can exploit this by supplying specially crafted negative offset values, leading to out-of-bounds memory reads. This can result in the termination of the Java Virtual Machine (JVM), causing a Denial of Service (DoS), or the disclosure of sensitive information by extracting arbitrary frame size data from unintended memory locations.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read() method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from accessing the stream, ultimately leading to a Denial of Service (DoS) for the affected application.
4.0 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
References
206 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.27.5.SP2 includes the following CVE fixes:\n\n* hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [quarkus-3.27] (CVE-2026-77874)\n\n* jsoup: Cross-site scripting flaw requires a custom Safelist that explicitly allows raw-text elements [quarkus-3.27] (CVE-2026-71497)\n\n* wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [quarkus-3.27] (CVE-2026-19611)\n\n* quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver [quarkus-3.27] (CVE-2026-81829)\n\n* reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure [quarkus-3.27] (CVE-2026-47857)\n\n* reactor-core: Reactor Core: Denial of Service in bufferTimeout operator [quarkus-3.27] (CVE-2026-47863)\n\n* quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering [quarkus-3.27] (CVE-2026-87742)\n\n* quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security [quarkus-3.27] (CVE-2026-87743)\n\n* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [quarkus-3.27] (CVE-2026-87825)\n\n* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [quarkus-3.27] (CVE-2026-87877)\n\n* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [quarkus-3.27] (CVE-2026-87795)\n\n* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [quarkus-3.27] (CVE-2026-87824)\n\n* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [quarkus-3.27] (CVE-2026-89046)\n\n* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [quarkus-3.27] (CVE-2026-90560)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [quarkus-3.27] (CVE-2026-58059)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [quarkus-3.27] (CVE-2026-12860)\n\n* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [quarkus-3.27] (CVE-2026-90852)\n\n* zstd-jni: zstd-jni: Denial of Service via negative length parameter [quarkus-3.27] (CVE-2026-89045)\n\n* zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read [quarkus-3.27] (CVE-2026-87823)\n\n* netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [quarkus-3.27] (CVE-2026-93488)\n\n* netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [quarkus-3.27] (CVE-2026-93491)\n\n* netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [quarkus-3.27] (CVE-2026-93558)\n\n* netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) [quarkus-3.27] (CVE-2026-93564)\n\n* netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [quarkus-3.27] (CVE-2026-93565)\n\n* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [quarkus-3.27] (CVE-2026-93567)\n\n* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [quarkus-3.27] (CVE-2026-93568)\n\n* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [quarkus-3.27] (CVE-2026-93569)\n\n* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [quarkus-3.27] (CVE-2026-93492)\n\n* netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [quarkus-3.27] (CVE-2026-93562)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [quarkus-3.27] (CVE-2026-93566)\n\n* netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [quarkus-3.27] (CVE-2026-93573)\n\n* netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [quarkus-3.27] (CVE-2026-93574)\n\n* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [quarkus-3.27] (CVE-2026-93579)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:69470",
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.5.SP2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.5.SP2"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
},
{
"category": "external",
"summary": "QUARKUS-8740",
"url": "https://issues.redhat.com/browse/QUARKUS-8740"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69470.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP2 release and security update",
"tracking": {
"current_release_date": "2026-10-08T23:36:47+00:00",
"generator": {
"date": "2026-10-08T23:36:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:69470",
"initial_release_date": "2026-09-21T16:19:28+00:00",
"revision_history": [
{
"date": "2026-09-21T16:19:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-21T16:19:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-08T23:36:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.27.5.SP2",
"product": {
"name": "Red Hat build of Quarkus 3.27.5.SP2",
"product_id": "Red Hat build of Quarkus 3.27.5.SP2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.27::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12860",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:01:02.591427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "RHBZ#2510256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
"url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
}
],
"release_date": "2026-08-03T02:55:58.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
},
{
"acknowledgments": [
{
"names": [
"LiuBo-keep (aidan)"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-19611",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"discovery_date": "2026-07-24T14:34:50+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "RHBZ#2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
}
],
"release_date": "2026-07-24T14:34:50+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
},
{
"cve": "CVE-2026-47857",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-27T00:22:06.632020+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2524774"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service (DoS) condition. This could cause applications to become unresponsive or crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Reactor Core can result in a denial of service for applications configured to use the Flux.windowTimeout operator with fairBackpressure enabled. The impact is confined to service availability and requires the specific operator and backpressure setting to be actively deployed within the application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47857"
},
{
"category": "external",
"summary": "RHBZ#2524774",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524774"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47857"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-47857",
"url": "https://spring.io/security/cve-2026-47857"
}
],
"release_date": "2026-08-26T23:28:44.743000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure"
},
{
"cve": "CVE-2026-47863",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-27T00:22:09.843687+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2524775"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Reactor Core. Applications using the `Flux.bufferTimeout` operator with `fairBackpressure` enabled are vulnerable to a Denial of Service (DoS) condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang and making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Applications using the `Flux.bufferTimeout` operator with `fairBackpressure` enabled in Reactor Core are vulnerable to a Denial of Service condition. This impact is considered Moderate because exploitation requires a specific, non-default application configuration or usage pattern.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47863"
},
{
"category": "external",
"summary": "RHBZ#2524775",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524775"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47863"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47863",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47863"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-47863",
"url": "https://spring.io/security/cve-2026-47863"
}
],
"release_date": "2026-08-26T23:28:48.599000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications should avoid using the `Flux.bufferTimeout` operator with `fairBackpressure` enabled. Review application code for instances where `fairBackpressure` is explicitly enabled with `Flux.bufferTimeout` and consider alternative buffering strategies or disabling `fairBackpressure` if it is not strictly required for the application\u0027s functionality.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-08-03T03:02:32.846217+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510250"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "RHBZ#2510250",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
}
],
"release_date": "2026-08-03T02:41:30.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
},
{
"cve": "CVE-2026-71497",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-08-06T22:30:32.976264+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2512346"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This cross-site scripting flaw in jsoup requires a custom `Safelist` that explicitly allows raw-text elements, which is not a default configuration. Exploitation is limited to applications processing untrusted HTML with such a permissive custom `Safelist`, reducing the overall risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71497"
},
{
"category": "external",
"summary": "RHBZ#2512346",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512346"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71497"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70",
"url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/issues/2538",
"url": "https://github.com/jhy/jsoup/issues/2538"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1",
"url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8",
"url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"
}
],
"release_date": "2026-08-06T21:09:31.489000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names"
},
{
"cve": "CVE-2026-75140",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-08-20T16:23:22.032106+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520546"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsoup. A remote attacker could exploit an uncontrolled resource consumption vulnerability in the XmlTreeBuilder by providing a deeply nested XML document with uniquely-namespaced elements. This causes the builder to copy the entire inherited namespace map on every start element, leading to quadratic time and memory complexity. Successful exploitation could exhaust JVM heap memory, resulting in an OutOfMemoryError and terminating the application, effectively causing a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in jsoup. Parsing deeply nested XML documents can cause a denial of service via excessive stack consumption, leading to a StackOverflowError. An attacker who can supply untrusted XML input to an application using jsoup for parsing can exploit this to crash the application or exhaust system resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75140"
},
{
"category": "external",
"summary": "RHBZ#2520546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520546"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75140"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a",
"url": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a"
},
{
"category": "external",
"summary": "https://github.com/jhy/jsoup/pull/2556",
"url": "https://github.com/jhy/jsoup/pull/2556"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder",
"url": "https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"
}
],
"release_date": "2026-08-20T15:56:50.377000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Validate and limit the nesting depth of XML documents before passing them to jsoup for parsing. Applications should implement input size limits and consider using iterative XML parsers for untrusted input. Where possible, restrict the sources of XML input to trusted origins only.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents"
},
{
"cve": "CVE-2026-77874",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-08-11T01:30:47.988000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513748"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM\u0027s Criteria API.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77874"
},
{
"category": "external",
"summary": "RHBZ#2513748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874"
}
],
"release_date": "2026-09-17T13:30:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass"
},
{
"acknowledgments": [
{
"names": [
"Sandipan Roy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-81829",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-27T13:44:10.828000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2524980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SmallRye JWT\u0027s AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it can be remotely triggered without authentication or user interaction but is limited to same-origin SSRF with read-only impact on the configured key endpoint host. Successful exploitation allows an attacker to force the application server to issue GET requests to arbitrary paths on the same origin, potentially reading non-public data exposed on that host. The vulnerability\u0027s root cause is a lack of input sanitization of the JWT kid header value before it is concatenated into the key-fetch URL in AwsAlbKeyResolver.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-81829"
},
{
"category": "external",
"summary": "RHBZ#2524980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-81829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81829"
}
],
"release_date": "2026-09-17T13:10:22+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver"
},
{
"acknowledgments": [
{
"names": [
"Michael Read"
],
"organization": "(https://github.com/Michael-JRead)"
}
],
"cve": "CVE-2026-87742",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-09T05:57:34.505000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530522"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `quarkus-websockets-next` extension of Red Hat Build of Quarkus. The flaw allows a remote attacker to exhaust application heap memory by sending a rapid stream of messages over a single WebSocket connection, leading to an OutOfMemoryError and subsequent JVM crash. This can result in service unavailability for affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87742"
},
{
"category": "external",
"summary": "RHBZ#2530522",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530522"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87742",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87742"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87742",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87742"
}
],
"release_date": "2026-09-17T13:10:22+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering"
},
{
"acknowledgments": [
{
"names": [
"Michael Read"
],
"organization": "https://github.com/Michael-JRead"
}
],
"cve": "CVE-2026-87743",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-09-09T06:09:47.486000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530523"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw as it allows unauthenticated attackers to bypass path-based access control rules in Quarkus HTTP security. The discrepancy in path normalization between the security matcher and HTTP request dispatchers could lead to unauthorized access to protected endpoints in applications deployed with Quarkus.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87743"
},
{
"category": "external",
"summary": "RHBZ#2530523",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530523"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87743"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87743",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87743"
}
],
"release_date": "2026-09-17T13:10:22+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security"
},
{
"cve": "CVE-2026-87795",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T10:21:04.988917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni caused by insufficient validation of offset and length values in the ZstdDictCompress constructor. An attacker who can influence these values may cause a JVM crash and potentially disclose native heap data. Affected Red Hat products are tracked through their existing remediation workflow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87795"
},
{
"category": "external",
"summary": "RHBZ#2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"release_date": "2026-09-09T10:07:28.656000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service"
},
{
"cve": "CVE-2026-87823",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T14:51:58.205748+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability arises from insufficient bounds checks in direct-ByteBuffer frame-size native methods, which allows attackers to provide negative or overflowing offsets. A remote attacker can exploit this by supplying specially crafted negative offset values, leading to out-of-bounds memory reads. This can result in the termination of the Java Virtual Machine (JVM), causing a Denial of Service (DoS), or the disclosure of sensitive information by extracting arbitrary frame size data from unintended memory locations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An out-of-bounds read flaw was found in zstd-jni. Versions before 1.5.7-14 perform insufficient bounds validation in direct ByteBuffer frame-size native methods. An attacker who can provide crafted input with negative or overflowing offsets may cause the JVM to terminate or disclose data from unintended memory locations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87823"
},
{
"category": "external",
"summary": "RHBZ#2531004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87823"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87823",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87823"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac",
"url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f",
"url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
}
],
"release_date": "2026-09-09T14:32:43.442000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Update zstd-jni to version 1.5.7-14 or later. If an update is not immediately possible, do not pass attacker-controlled buffers or offsets to the affected frame-size methods. Validate offsets and lengths before invoking zstd-jni native methods.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read"
},
{
"cve": "CVE-2026-87824",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T14:51:05.674319+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87824 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow a remote attacker to terminate the Java Virtual Machine by supplying crafted sample lengths to the dictionary-training function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "RHBZ#2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980",
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"release_date": "2026-09-09T14:32:44.099000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect"
},
{
"cve": "CVE-2026-87825",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T14:52:13.405564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary\u0027s shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in zstd-jni that could lead to silent data corruption or JVM crashes due to a use-after-free vulnerability. The flaw arises when a dictionary is prematurely closed while still actively referenced by compression or decompression streams, potentially impacting Red Hat products that utilize zstd-jni for data handling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "RHBZ#2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"release_date": "2026-09-09T14:32:44.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability"
},
{
"cve": "CVE-2026-87877",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-09T14:51:43.444501+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87877 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow memory corruption or denial of service when specific stream methods are called after the stream has been closed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "RHBZ#2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"release_date": "2026-09-09T14:32:45.512000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service"
},
{
"cve": "CVE-2026-89045",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-09-10T17:51:11.831336+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531570"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read() method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from accessing the stream, ultimately leading to a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this Moderate, consistent with upstream\u0027s own CVSS 3.1 score of 4.0, for the same reason: the negative length has to come from the calling application\u0027s own logic, not from an attacker-controlled value received directly over a wire protocol. \n\nOnly the three-argument ZstdInputStreamNoFinalizer.read(byte[], int, int) overload is reachable this way; the caller has to already have a defect in its own length calculation, a bad remaining-bytes count for example, to hand zstd-jni a negative value in the first place, since InputStream\u0027s single-argument read() and read(byte[]) never produce one.\n\nWhere it is reachable, the failure is a single thread spinning and holding one stream instance\u0027s lock indefinitely, not memory corruption, data exposure, or privilege escalation, and it doesn\u0027t propagate to stream instances the hung caller isn\u0027t sharing. That combination, a caller-side prerequisite plus an impact bounded to one thread and one stream object, is why this stays Moderate rather than Important despite being a straightforward-looking DoS trigger on paper.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89045"
},
{
"category": "external",
"summary": "RHBZ#2531570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531570"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89045"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89045",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89045"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length"
}
],
"release_date": "2026-09-10T17:39:34.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "If your integration calls read(byte[], int, int) directly with a computed length, for example a remaining-bytes calculation, add a len \u003e= 0 check before the call. If you can\u0027t change the call site, avoid sharing a single ZstdInputStreamNoFinalizer instance across threads or requests, so a bad input only stalls the one caller that triggered it instead of every other caller waiting on the same stream.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter"
},
{
"cve": "CVE-2026-89046",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-10T17:51:53.452234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni when a negative source position is supplied to Zstd.getFrameContentSize. This may disclose native memory or cause a JVM crash. Affected Red Hat products are tracked for updates containing zstd-jni 1.5.7-14 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89046"
},
{
"category": "external",
"summary": "RHBZ#2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"release_date": "2026-09-10T17:39:35.519000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read"
},
{
"cve": "CVE-2026-90560",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-12T18:10:57.851894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532604"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that affected versions of zstd-jni are vulnerable to an out-of-bounds read in the ZstdDictDecompress constructor. An attacker who can cause an application to supply invalid dictionary offset or length values may terminate the Java Virtual Machine, resulting in denial of service. Red Hat is tracking fixes for affected products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90560"
},
{
"category": "external",
"summary": "RHBZ#2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37",
"url": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f",
"url": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/405",
"url": "https://github.com/luben/zstd-jni/issues/405"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress"
}
],
"release_date": "2026-09-12T18:06:43.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress"
},
{
"cve": "CVE-2026-90852",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-15T02:41:02.899732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote use-after-free vulnerability in the `zstd-jni` library\u0027s dictionary sharing functionality. The flaw, affecting the `ZstdCompressCtx.loadDict` function, could allow an unauthenticated attacker to trigger a crash or potentially execute arbitrary code due to public exploit disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "RHBZ#2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/",
"url": "https://github.com/luben/zstd-jni/"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/404",
"url": "https://github.com/luben/zstd-jni/issues/404"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-90852",
"url": "https://vuldb.com/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/927022",
"url": "https://vuldb.com/submit/927022"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407",
"url": "https://vuldb.com/vuln/403407"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407/cti",
"url": "https://vuldb.com/vuln/403407/cti"
}
],
"release_date": "2026-09-15T02:15:10.581000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing"
},
{
"cve": "CVE-2026-93488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:39:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "RHBZ#2536887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:39:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
},
{
"cve": "CVE-2026-93491",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:40:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536891"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "RHBZ#2536891",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:40:47+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
},
{
"cve": "CVE-2026-93492",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:41:18+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "RHBZ#2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
}
],
"release_date": "2026-09-10T00:41:18+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
},
{
"cve": "CVE-2026-93558",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:42:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "RHBZ#2536932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
}
],
"release_date": "2026-09-10T00:42:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
},
{
"cve": "CVE-2026-93562",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:45:54+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/1 decoder allows HTTP request smuggling by incorrectly validating `Transfer-Encoding` headers. This can enable an attacker to inject arbitrary HTTP requests, primarily impacting Red Hat products deployed in environments with parser-differential proxies or load balancers, such as Red Hat AMQ, JBoss Fuse, Enterprise Application Platform, and Red Hat Build of Quarkus. The vulnerability arises from an incomplete fix, making it crucial to ensure consistent HTTP parsing across all network components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93562"
},
{
"category": "external",
"summary": "RHBZ#2536951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
}
],
"release_date": "2026-09-10T00:45:54+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling"
},
{
"cve": "CVE-2026-93564",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:46:51+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "RHBZ#2536953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
}
],
"release_date": "2026-09-10T00:46:51+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
},
{
"cve": "CVE-2026-93565",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:19+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "RHBZ#2536952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
}
],
"release_date": "2026-09-10T00:47:19+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
},
{
"cve": "CVE-2026-93566",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows HTTP request smuggling. The vulnerability stems from improper validation of chunk size lines, enabling an attacker to inject arbitrary HTTP requests. This could lead to cache poisoning or bypassing security controls in Red Hat products that use affected Netty components and process untrusted HTTP traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93566"
},
{
"category": "external",
"summary": "RHBZ#2536954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
}
],
"release_date": "2026-09-10T00:47:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
},
{
"cve": "CVE-2026-93573",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:52:26+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Netty\u0027s HTTP/1.1 decoder allows for HTTP request smuggling by incorrectly processing split `Transfer-Encoding` headers. When Netty is deployed with an intermediary that interprets these headers differently, an attacker could bypass front-end security controls or desynchronize request processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93573"
},
{
"category": "external",
"summary": "RHBZ#2536964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
}
],
"release_date": "2026-09-10T00:52:26+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling"
},
{
"cve": "CVE-2026-93574",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:52:52+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536966"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in Netty\u0027s HTTP/1.1 chunk-size parsing allows for HTTP request smuggling in proxy/backend deployments. By accepting post-digit whitespace in chunk-size tokens, Netty can misinterpret malformed chunked bodies, leading to a desynchronization between Netty and other HTTP components in the request path. This could enable an attacker to smuggle requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93574"
},
{
"category": "external",
"summary": "RHBZ#2536966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536966"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
}
],
"release_date": "2026-09-10T00:52:52+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing"
},
{
"cve": "CVE-2026-93579",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:55:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "RHBZ#2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
}
],
"release_date": "2026-09-10T00:55:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-21T16:19:28+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:69470"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.5.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…