Red Hat Red Hat Build Of Quarkus
57 CVEs affecting Red Hat Red Hat Build Of Quarkus. Latest disclosed: 2026-10-12. Critical: 2, High: 35.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87744 | Critical | 9.1 | 2026-10-12 | A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a d… |
CVE-2024-12225 | Critical | 9.1 | 2025-05-06 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and… |
CVE-2026-12894 | High | 8.8 | 2026-08-31 | A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component… |
CVE-2026-93569 | High | 8.2 | 2026-09-18 | A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request… |
CVE-2026-9800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and… |
CVE-2024-1132 | High | 8.1 | 2024-04-17 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious requ… |
CVE-2023-4853 | High | 8.1 | 2023-09-20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in inco… |
CVE-2022-1415 | High | 8.1 | 2023-09-11 | A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to… |
CVE-2026-94449 | High | 7.5 | 2026-09-21 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. T… |
CVE-2026-93568 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's… |
CVE-2026-93567 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONN… |
CVE-2026-93565 | High | 7.5 | 2026-09-18 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming… |
CVE-2026-93564 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted P… |
CVE-2026-93558 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to… |
CVE-2026-93491 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single conn… |
CVE-2026-93488 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Int… |
CVE-2026-87743 | High | 7.5 | 2026-09-18 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and H… |
CVE-2026-89059 | High | 7.5 | 2026-09-18 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensi… |
CVE-2026-87742 | High | 7.5 | 2026-09-17 | A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single… |
CVE-2026-17615 | High | 7.5 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending… |