Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus REST Data Panache, Quarkus Qute, Jackson Core, Jackson Data Binding, RESTEasy, yawkat LZ4 Java, Micrometer Core, MariaDB Connector/J, MongoDB Java Driver, Neethi Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTIO...

CVE-2026-77874

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in JSoup, Elytron, Reactor, BouncyCastle and zstd-jni Vulnerability Details CVEID:CVE-2026-75140 DESCRIPTION: jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874

IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1) is vulnerable to SQL injection within the Hibernate component. A remote unauthenticated attacker can send specially crafted SQL statements, potentially allowing them to view, add, modify, or delete...

EUVD-2026-86012

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

Red Hat: CVE-2026-77874: org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

PT-2026-97838

Name of the Vulnerable Software and Affected Versions IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 IBM Enterprise Build of Quarkus versions 3.33.1 through 3.33.3.SP1 Description An issue exists where a remote unauthenticated attacker can execute SQL injection by sending...

CVE-2026-77874: Improper Neutralization of Special Elements used in an SQL Command

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus Core Security, SmallRye JWT, Hibernate and WebSockets.next Vulnerability Details CVEID:CVE-2026-87743 DESCRIPTION: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in...

CVE-2026-19651 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

CVE-2026-19651: Authorization Bypass Through User-Controlled Key

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

CVE-2026-16308: Allocation of Resources Without Limits or Throttling

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by an authentication/authentization bypass vulnerability

Summary Security Bulletin: IBM Enterprise Build of Quarkus is affected by an authentication/authentization bypass vulnerability Vulnerability Details ID: CVE-2026-50559 DESCRIPTION: Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1,...