CVE-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

CVE-2026-19625

CVE-2026-19625 is a cross-tenant authentication bypass in the OIDC extension of IBM Enterprise Build of Quarkus . When an optional token-introspection cache is enabled, a valid token issued by one OIDC provider tenant can be used to access endpoints secured by a different tenant, because the shar...

CVE-2026-19651

CVE-2026-19651 affects the quarkus-spring-web extension in IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3 . The root cause is that the system incorrectly reads the URL query string as a request header, resulting in incorrect mapping of values to untrusted query string in...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Proton-J, MongoDB Client, Apache HTTP Client and Netty Vulnerability Details CVEID:CVE-2026-59903 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

CVE-2026-16308 IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

CVE-2026-16308 IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

PT-2026-66488

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by a vulnerability in Apache Kafka

Summary IBM Enterprise Build of Quarkus is affected by a vulnerability in Apache Kafka Vulnerability Details CVEID:CVE-2026-35554 DESCRIPTION: A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a...