Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP2 release and security update
🔗 CVE IDs covered (34)
📋 Description
CVE-2026-12860 — org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification CVE-2026-19611 — wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding CVE-2026-47857 — io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure CVE-2026-47863 — io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator CVE-2026-58059 — org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names CVE-2026-71497 — org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names CVE-2026-75140 — org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents CVE-2026-77874 — org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass CVE-2026-81829 — smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver CVE-2026-87742 — quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering CVE-2026-87743 — quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security CVE-2026-87795 — com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service CVE-2026-87823 — com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read CVE-2026-87824 — com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect CVE-2026-87825 — com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability CVE-2026-87877 — com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service CVE-2026-89045 — com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter CVE-2026-89046 — zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read CVE-2026-90560 — com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress CVE-2026-90852 — com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing CVE-2026-93488 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams CVE-2026-93491 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue CVE-2026-93492 — io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size CVE-2026-93558 — io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service CVE-2026-93562 — io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling CVE-2026-93564 — io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) CVE-2026-93565 — io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte CVE-2026-93566 — io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line CVE-2026-93567 — io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority CVE-2026-93568 — io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests CVE-2026-93569 — io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority CVE-2026-93573 — io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling CVE-2026-93574 — io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing CVE-2026-93579 — io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
🎯 Affected products1
- Red Hat build of Quarkus 3.27.5.SP2
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications should avoid using the `Flux.bufferTimeout` operator with `fairBackpressure` enabled. Review application code for instances where `fairBackpressure` is explicitly enabled with `Flux.bufferTimeout` and consider alternative buffering strategies or disabling `fairBackpressure` if it is not strictly required for the application's functionality. Workaround: Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names. Workaround: Validate and limit the nesting depth of XML documents before passing them to jsoup for parsing. Applications should implement input size limits and consider using iterative XML parsers for untrusted input. Where possible, restrict the sources of XML input to trusted origins only. Workaround: To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress. Workaround: Update zstd-jni to version 1.5.7-14 or later. If an update is not immediately possible, do not pass attacker-controlled buffers or offsets to the affected frame-size methods. Validate offsets and lengths before invoking zstd-jni native methods. Workaround: No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: If your integration calls read(byte[], int, int) directly with a computed length, for example a remaining-bytes calculation, add a len >= 0 check before the call. If you can't change the call site, avoid sharing a single ZstdInputStreamNoFinalizer instance across threads or requests, so a bad input only stalls the one caller that triggered it instead of every other caller waiting on the same stream. Workaround: Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation. Workaround: Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2026:69470
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/products/quarkus/
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.27.5.SP2
- externalhttps://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27
- externalhttps://issues.redhat.com/browse/QUARKUS-8740
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69470.json