CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

[
  {
    "vendor": "Quarkus",
    "product": "quarkus-qute",
    "versions": [
      {
        "status": "affected",
        "version": "3.27.0",
        "lessThan": "3.27.5.SP1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.33.0",
        "lessThan": "3.33.3.SP1",
        "versionType": "semver"
      }
    ],
    "packageName": "io.quarkus:quarkus-qute",
    "collectionURL": "https://repo1.maven.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "camel-quarkus-qute",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "camel-quarkus-qute-component",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "quarkus-qute",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "camel-quarkus-qute",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "camel-quarkus-qute-component",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "quarkus-qute",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  }
]