RHSA-2026:83082HighCVSS 9.1

Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6 release and security update

Published
October 15, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (24)

CVE-2026-68497 →CVE-2026-87744 →CVE-2026-88033 →CVE-2026-89058 →CVE-2026-89407 →CVE-2026-91777 →CVE-2026-93432 →CVE-2026-19032 →CVE-2026-59949 →CVE-2026-71889 →CVE-2026-88032 →CVE-2026-94449 →CVE-2026-55857 →CVE-2026-55858 →CVE-2026-59295 →CVE-2026-84939 →CVE-2026-89059 →CVE-2026-94451 →CVE-2026-55856 →CVE-2026-59296 →CVE-2026-83557 →CVE-2026-89425 →CVE-2026-91776 →CVE-2026-93879 · pending

📋 Description

CVE-2026-19032 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization CVE-2026-55856 — org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake CVE-2026-55857 — org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication CVE-2026-55858 — org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch CVE-2026-59295 — io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures CVE-2026-59296 — io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing CVE-2026-59949 — lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-71889 — org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks CVE-2026-83557 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation CVE-2026-84939 — org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier CVE-2026-87744 — io.quarkus:quarkus-hibernate-orm-rest-data-panache: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations CVE-2026-88032 — mongodb-java-driver: mongodb-driver-reactivestreams: mongodb-crypt: MongoDB Java Driver: Denial of Service via use-after-free in client-side encryption cancellation CVE-2026-88033 — org.mongodb/mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs CVE-2026-89058 — resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config CVE-2026-89059 — resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) CVE-2026-89407 — com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89425 — com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-91776 — jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase CVE-2026-91777 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion CVE-2026-93432 — io.quarkus.qute:quarkus-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus CVE-2026-93879 — org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS) CVE-2026-94449 — quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service CVE-2026-94451 — quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache

🎯 Affected products200

  • Red Hat build of Quarkus 3.27.6.redhat
  • aopalliance.aopalliance-1.0.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.aayushatharva.brotli4j.brotli4j-1.23.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.aayushatharva.brotli4j.native-linux-x86_64-1.23.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.aayushatharva.brotli4j.service-1.23.0.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.apollographql.federation.federation-graphql-java-support-4.4.0.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.cronutils.cron-utils-9.2.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.dajudge.kindcontainer.kindcontainer-1.4.9.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.ethlo.time.itu-1.14.0.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.classmate-1.7.0.redhat-00002.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.core.jackson-annotations-2.21.0.redhat-00002.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.dataformat.jackson-dataformat-properties-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.dataformat.jackson-dataformat-xml-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.dataformat.jackson-dataformat-yaml-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.datatype.jackson-datatype-jdk8-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.datatype.jackson-datatype-jsr310-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-base-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.jakarta.rs.jackson-jakarta-rs-json-provider-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.module.jackson-module-jakarta-xmlbind-annotations-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.jackson.module.jackson-module-parameter-names-2.21.7.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.fasterxml.woodstox.woodstox-core-7.1.1.redhat-00002.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.ben-manes.caffeine.caffeine-3.2.3.redhat-00003.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.docker-java.docker-java-api-3.4.2.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.docker-java.docker-java-transport-3.4.2.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.docker-java.docker-java-transport-zerodep-3.4.2.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.java-json-tools.btf-1.3.0.redhat-00005.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • com.github.java-json-tools.jackson-coreutils-2.0.0.redhat-00011.jar as a component of Red Hat build of Quarkus 3.27.6.redhat
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For information about how to apply this update, see https://access.redhat.com/articles/11258. Workaround: Avoid deserializing java.nio.file.Path from untrusted JSON input. If the application does not use Path deserialization, no remediation is required. Otherwise, upgrade jackson-databind to a fixed version: 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core), or 3.1.6 / 3.2.2 (tools.jackson.core). As a workaround, register a custom deserializer for java.nio.file.Path that validates or rejects input before URI resolution, or configure the ObjectMapper to deny Path deserialization entirely. Workaround: When using sslMode verify-ca or verify-full, configure serverSslCert or a trustStore so the JDBC client validates the server certificate before sending credentials. Upgrade to MariaDB Connector/J 2.7.14, 3.3.5, 3.4.3, or 3.5.9 when available in your product update stream. Workaround: Connect using sslMode=verify-full (or verify-ca) with a properly configured server certificate and trust store, or use a local Unix socket, so the connector never negotiates PAM dialog authentication over cleartext. Setting restrictedAuth to exclude the dialog/mysql_clear_password plugins also prevents disclosure. A fixed MariaDB Connector/J (2.7.14, 3.3.5, 3.4.3, or 3.5.9, as appropriate for the branch in use) additionally addresses the issue. Workaround: Upgrade MariaDB Connector/J to a fixed version (2.7.14, 3.3.5, 3.4.3, or 3.5.9, as appropriate for the branch in use), which rejects any post-initialization character set other than utf8, utf8mb3, or utf8mb4 and closes the connection. Where upgrading is not immediately possible, avoid changing character_set_client after connection establishment and connect only to trusted database servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Use XXHashFactory.safeInstance() or XXHashFactory.fastestJavaInstance() instead of XXHashFactory.nativeInstance() to avoid the JNI boundary. Alternatively, validate that arrays are non-null and that offset and length parameters describe a range fully contained in the array before calling native XXHash methods. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: Do not use PKIXCertPathReviewer for trust or path validation decisions. Instead, validate certificate paths using the standard Java Cryptography Architecture via CertPathValidator.getInstance("PKIX", "BC"). Workaround: If immediate upgrade is not possible, audit for @JsonTypeInfo properties typed as java.lang.Comparable without a custom PolymorphicTypeValidator. Narrow the type or add a validator that denies java.io.File and similar Comparable implementations. This doesn't apply to global default typing (activateDefaultTyping), which already requires an explicit validator. Workaround: To mitigate this vulnerability, disable the localized lookup configuration setting within your Apache FreeMarker deployment. This setting is enabled by default and its deactivation prevents the processing of malformed locale identifiers that could lead to path traversal. Consult your application's documentation for specific instructions on how to configure FreeMarker to disable localized lookup. A restart of the affected application or service will be required for the changes to take effect. Disabling localized lookup may impact applications that rely on this feature for internationalization. Workaround: To mitigate this issue, restrict network access to Quarkus applications utilizing REST Data Panache to trusted networks or localhost. This can be achieved by configuring firewall rules or network access controls to limit exposure of the affected endpoints. A restart of the application may be required for network configuration changes to take effect. Workaround: Mitigation for this issue involves ensuring that applications using the MongoDB Java Driver's GridFS component rigorously validate and sanitize all user-supplied input intended for file identifiers. Restricting access to such applications to only trusted users can further reduce the attack surface. Workaround: Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24. Example `pom.xml`: ``` <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.18.11</version> </dependency> ``` Verify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind` If you cannot upgrade directly, apply defense-in-depth mitigations: - Restrict JSON request size - Audit and remove unnecessary @JsonIdentityInfo Workaround: Users who cannot immediately upgrade can mitigate this issue by updating their templates to use the str:eval extension method instead of the {#eval} section helper. Vulnerable pattern: {#eval snippet /} Secure alternative: {str:eval(snippet)}

🔗 References (58)