RHSA-2026:26018HighCVSS 8.7

Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP1 security update

Published
June 17, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (14)

CVE-2026-44249 →CVE-2026-44893 →CVE-2026-45674 →CVE-2026-47244 →CVE-2026-48043 →CVE-2026-50010 →CVE-2026-50559 →CVE-2026-50560 →CVE-2026-6860 →CVE-2026-45416 →CVE-2026-45673 →CVE-2026-47691 →CVE-2026-48059 →CVE-2026-50020 →

📋 Description

CVE-2026-6860 — eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name CVE-2026-44249 — netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation CVE-2026-44893 — netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message CVE-2026-45416 — netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake CVE-2026-45673 — netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs CVE-2026-45674 — netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation CVE-2026-47244 — netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams CVE-2026-47691 — io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records CVE-2026-48043 — netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak CVE-2026-48059 — netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers CVE-2026-50010 — netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass CVE-2026-50020 — netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder CVE-2026-50559 — io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters CVE-2026-50560 — netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling

🎯 Affected products1

  • Red Hat build of Quarkus 3.27.4.SP1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect. Workaround: Configure affected applications using Netty HTTP/2 servers to explicitly set a maximum concurrent streams limit. Consult product-specific documentation for instructions on how to apply this configuration. Additionally, restrict network access to affected services to trusted clients and networks by implementing firewall rules or other network access controls. This may impact legitimate traffic if not carefully configured.

🔗 References (8)