Red Hat Quarkus
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Quarkus.
Recent Red Hat Quarkus Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:70257 | (RHSA-2026:70257) Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2) | September 22, 2026 |
| RHSA-2026:69440 | (RHSA-2026:69440) Important: Red Hat build of Quarkus 3.33.3.SP2 release and security update | September 21, 2026 |
| RHSA-2026:69470 | (RHSA-2026:69470) Important: Red Hat build of Quarkus 3.27.5.SP2 release and security update | September 21, 2026 |
| RHSA-2026:63302 | (RHSA-2026:63302) Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1) | September 3, 2026 |
| RHSA-2026:62555 | (RHSA-2026:62555) Important: Red Hat build of Quarkus 3.33.3.SP1 release and security update | September 3, 2026 |
| RHSA-2026:62515 | (RHSA-2026:62515) Important: Red Hat build of Quarkus 3.27.5.SP1 release and security update | September 3, 2026 |
| RHSA-2026:54776 | (RHSA-2026:54776) Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA) | August 13, 2026 |
| RHSA-2026:51653 | (RHSA-2026:51653) Important: Red Hat build of Quarkus 3.33.3 release and security update | August 13, 2026 |
| RHSA-2026:53643 | (RHSA-2026:53643) Important: Red Hat build of Quarkus 3.27.5 release and security update | August 13, 2026 |
| RHSA-2026:47172 | (RHSA-2026:47172) Important: Red Hat build of Quarkus 3.33.2.SP3 security update | July 30, 2026 |
By the Year
In 2026 there have been 62 vulnerabilities in Red Hat Quarkus with an average score of 7.4 out of ten. Last year, in 2025 Quarkus had 5 security vulnerabilities published. That is, 57 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.62
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 62 | 7.36 |
| 2025 | 5 | 7.98 |
| 2024 | 15 | 6.49 |
| 2023 | 6 | 6.00 |
| 2022 | 1 | 7.50 |
It may take a day or so for new Quarkus vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Quarkus Security Vulnerabilities
SmallRye Fault Tolerance memory leak causing resource exhaustion
CVE-2026-94449
7.5 - High
- September 21, 2026
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
Resource Exhaustion
Netty HTTP/1 Decoder Request Smuggling via Malformed Transfer-Encoding
CVE-2026-93562
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty netty-codec-http HTTP Smuggling via Chunk-Size Post-Digit Whitespace
CVE-2026-93574
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
HTTP Request Smuggling
RedHat Quarkus Qute XSS via Unescaped eval Sub-Template
CVE-2026-93432
6.1 - Medium
- September 18, 2026
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
XSS
Netty HTTP/2 Header Field Injection Vulnerability (CVE-2026-93579)
CVE-2026-93579
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty Transfer-Encoding Field Split Bypass Enables Request Smuggling
CVE-2026-93573
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
HTTP Request Smuggling
Red Hat: HTTP/2/3 EXT CONNECT Downgrade in Apache HTTPd
CVE-2026-93568
7.5 - High
- September 18, 2026
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
Improper Input Validation
Netty HTTP/1HTTP/2 Host Header Conflict Allows Unauthorized Access
CVE-2026-93569
8.2 - High
- September 18, 2026
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
HTTP Request Smuggling
Netty HTTP/2 CONNECT Host Header Exploit Bypass Tunnel Allow-List
CVE-2026-93567
7.5 - High
- September 18, 2026
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
Improper Input Validation
WildFly Elytron ASN1 DERDecoder DoS via Excessive Memory Allocation
CVE-2026-10832
5.9 - Medium
- September 18, 2026
A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.
Allocation of Resources Without Limits or Throttling
Netty HTTP Request Smuggling via Chunk-Size Line Bypass
CVE-2026-93566
6.5 - Medium
- September 18, 2026
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty RtspDecoder Method-Token Smuggling via RTSP Request
CVE-2026-93565
7.5 - High
- September 18, 2026
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HAProxy PROXY-v2 RefCnt Leak: Remote DoS
CVE-2026-93564
7.5 - High
- September 18, 2026
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty WebSocketServerExtensionHandler DoS via HTTP/1.1 Pipelining Queue Overflow
CVE-2026-93558
7.5 - High
- September 18, 2026
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HpackEncoder DoS via oversized SETTINGS MAX_HEADER_TABLE_SIZE
CVE-2026-93492
5.3 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HttpServerCodec DoS via HTTP/1.1 pipelining (before 4.2)
CVE-2026-93491
7.5 - High
- September 18, 2026
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
Allocation of Resources Without Limits or Throttling
Netty SpdySessionHandler Unbounded Streams DoS
CVE-2026-93488
7.5 - High
- September 18, 2026
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
Allocation of Resources Without Limits or Throttling
Quarkus HTTP Security Authorization Bypass via Path Normalization Discrepancy
CVE-2026-87743
7.5 - High
- September 18, 2026
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin Access
CVE-2026-89058
7.4 - High
- September 18, 2026
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Permissive Cross-domain Policy with Untrusted Domains
RESTEasy IIOImageProv Unbounded Image Dimension DoS
CVE-2026-89059
7.5 - High
- September 18, 2026
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Data Amplification
Quarkus WebSockets-Next DoS via Unbounded Message Buffering
CVE-2026-87742
7.5 - High
- September 17, 2026
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).
Allocation of Resources Without Limits or Throttling
Red Hat SmallRye JWT Remote Path Traversal - AwsAlbKeyResolver
CVE-2026-81829
5.3 - Medium
- September 17, 2026
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
Directory traversal
XXE in RESTEasy SourceProvider Enables Remote File Read
CVE-2026-17615
7.5 - High
- August 31, 2026
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
XXE
Unauth Remote DoS via BigInteger Coercion in SmallRye GraphQL
CVE-2026-76763
7.5 - High
- August 31, 2026
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
Improper Validation of Specified Quantity in Input
Qute RefResolver bypass allows code exec in Quarkus
CVE-2026-12894
8.8 - High
- August 31, 2026
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.
1336
WildFly Elytron Unicode Normalization Weakens Password Hashing
CVE-2026-19611
7.4 - High
- August 20, 2026
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Improper Handling of Alternate Encoding
Keycloak Policy Enforcer Auth Bypass via Access-Denied Page Injection
CVE-2026-9800
8.1 - High
- June 25, 2026
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Comparison Using Wrong Factors
Jackson-Databind PTV Array Type Allowlist Bypass 2.10.0-2.18.8, 2.21.4, 3.1.4
CVE-2026-54513
8.1 - High
- June 23, 2026
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Denylist / Deny List
Quarkus HTTP Auth Bypass via Encoded ; and / Fixed 3.37.0
CVE-2026-50559
7.5 - High
- June 19, 2026
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
authentification
Netty 4.1/4.2 X509MT Wrapper Bug: No Hostname Verification
CVE-2026-50010
7.5 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Improper Verification of Cryptographic Signature
Netty <4.1.135 / <4.2.15 HAProxy PROXY v2 codec memory leak (PP2_TYPE_SSL)
CVE-2026-48059
7.5 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Memory Leak
Netty netty-codec-http2 HTTP2 Decompressor Resource Leak pre 4.1.135/4.2.15
CVE-2026-48043
7.5 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Resource Exhaustion
Netty <=4.2.15 DNS Cache Poisoning via DnsResolveContext
CVE-2026-47691
8.7 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Insufficient Verification of Data Authenticity
Netty DnsResolveContext CNAME Bailiwick Validation Flaw (before 4.1.135,4.2.15)
CVE-2026-45674
8.7 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Insufficient Verification of Data Authenticity
Netty <4.1.135 / <4.2.15 TLS ClientHello Buffer Overflow
CVE-2026-45416
7.5 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Allocation of Resources Without Limits or Throttling
Netty netty-codec-haproxy 4.1.x/4.2.x Memory Leak via HAProxyMessage TLV
CVE-2026-44893
7.5 - High
- June 12, 2026
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Improper Check or Handling of Exceptional Conditions
Netty IpSubnetFilterRule IPv6 Bypass < 4.1.135/4.2.15
CVE-2026-44249
8.1 - High
- June 11, 2026
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Authorization
Micrometer Core & Jetty 1.131.16.5 DoS via crafted HTTP reqs
CVE-2026-40984
7.5 - High
- June 09, 2026
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Resource Exhaustion
Micrometer 1.15/1.16 gRPC DoS via crafted requests
CVE-2026-40983
7.5 - High
- June 09, 2026
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Resource Exhaustion
CVE-2026-44604: rpmuncompress Command Injection W/O Sanitization
CVE-2026-44604
7 - High
- May 28, 2026
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.
Shell injection
Netty 4.x HttpContentDecompressor OOM DoS via br, zstd, snappy bypass
CVE-2026-42587
7.5 - High
- May 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Resource Exhaustion
Netty HttpClientCodec pairing bug fixed in 4.2.13 & 4.1.133
CVE-2026-42584
7.3 - High
- May 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that messages body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
HTTP Request Smuggling
Netty DNS Codec Domain Constraint Bypass (<=4.2.13, <=4.1.133)
CVE-2026-42579
7.5 - High
- May 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Improper Input Validation
Netty HttpProxyHandler Header Injection (4.2.13.Final/4.1.133.Final)
CVE-2026-42578
7.5 - High
- May 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
HTTP Response Splitting
Netty HTTP request smuggling via chunked/Content-Length before 4.2.13.Final
CVE-2026-42581
7.2 - High
- May 13, 2026
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
HTTP Request Smuggling
urllib3 2.6.0-<2.7.0 Decompress Whole Response DoS via Brotli
CVE-2026-44432
7.5 - High
- May 13, 2026
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Data Amplification
Quarkus Path Normalization Bypass (unpatched < v3.20.6.1)
CVE-2026-39852
8.2 - High
- May 05, 2026
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.
AuthZ
pgjdbc 42.2.042.7.10 DoS via SCRAM PBKDF2
CVE-2026-42198
7.5 - High
- April 29, 2026
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.
Allocation of Resources Without Limits or Throttling
Apache HttpClient 5.6 Auth Bypass SCRAM-SHA-256 (CVE-2026-40542)
CVE-2026-40542
7.3 - High
- April 22, 2026
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Missing Critical Step in Authentication
Spring Security 7.0.07.0.4: Auth ByPass via Servlet Path
CVE-2026-22754
7.5 - High
- April 22, 2026
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Authorization
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Quarkus or by Red Hat? Click the Watch button to subscribe.
