Red Hat Red Hat build of Quarkus

• CVE-2026-107912 High 7.7 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 0.2%
• CVE-2026-120971 Medium 5.3 Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses 0.3%
• CVE-2026-93432 Medium 6.1 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus 1.2%
• CVE-2026-81829 Medium 5.3 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver 0.6%
• CVE-2026-9800 High 8.1 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison 0.7%
• CVE-2024-4027 High 7.5 Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks 0.4%
• CVE-2024-3884 High 7.5 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded 1.5%
• CVE-2024-12225 Critical 9.1 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass 0.4%
• CVE-2025-2240 High 7.5 Smallrye-fault-tolerance: smallrye fault tolerance 1.2%
• CVE-2025-1634 High 7.5 Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout 1.0%
• CVE-2023-4639 High 7.4 Undertow: cookie smuggling/spoofing 1.1%
• CVE-2023-6841 High 7.5 Keycloak: amount of attributes per object is not limited and it may lead to dos 0.7%
• CVE-2024-7885 High 7.5 Undertow: improper state management in proxy protocol parsing causes information leakage 2.6%
• CVE-2024-3653 Medium 5.3 Undertow: learningpushhandler can lead to remote memory dos attacks 1.9%
• CVE-2024-5971 High 7.5 Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket 2.9%
• CVE-2024-1726 Medium 5.3 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service 0.7%
• CVE-2023-6717 Medium 6.0 Keycloak: xss via assertion consumer service url in saml post-binding flow 0.7%
• CVE-2024-1132 High 8.1 Keycloak: path transversal in redirection validation 1.6%
• CVE-2024-2700 High 7.0 Quarkus-core: leak of local configuration properties into quarkus applications 0.3%
• CVE-2024-1300 Medium 5.4 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support 1.1%
• CVE-2024-1023 Medium 6.5 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx 1.7%
• CVE-2024-1979 Low 3.5 Quarkus: information leak in annotation 0.6%
• CVE-2024-1635 High 7.5 Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol 4.6%
• CVE-2023-5236 Medium 4.4 Infinispan: circular reference on marshalling leads to dos 1.1%
• CVE-2023-5379 High 7.5 Undertow: ajp request closes connection exceeding maxrequestsize 1.0%
• CVE-2023-6394 High 7.4 Quarkus: graphql operations over websockets bypass 0.8%
• CVE-2023-6393 Medium 5.3 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used 0.6%
• CVE-2023-3223 High 7.5 Undertow: outofmemoryerror due to @multipartconfig handling 2.7%
• CVE-2022-4245 Medium 4.3 Codehaus-plexus: xml external entity (xxe) injection 0.7%
• CVE-2022-4244 High 7.5 Codehaus-plexus: directory traversal 1.3%
• CVE-2023-4853 High 8.1 Quarkus: http security policy bypass 2.3%
• CVE-2023-1108 High 7.5 Undertow: infinite loop in sslconduit during close 1.8%
• CVE-2022-1415 High 8.1 Drools: unsafe data deserialization in streamutils 1.0%