Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6.SP1 security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

org.apache.camel.karaf:camel-as2 (>=4.7.0 <=4.8.9), org.apache.camel.karaf:camel-as2-test (>=4.7.0 <=4.8.9) +6 more potentially affected by CVE-2025-8916 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71 <=1.78)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-M1, =3.0.0-M1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =4.8.9 Source cves: CVE-2025-8916 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-11789690...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.0.0-M1 <=3.10.0), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.0.0-M1 <=3.10.0) +4 more potentially affected by CVE-2025-8885 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71 <=1.77)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =3.0.0-M1, =3.0.0-M1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =4.5.0 Source cves: CVE-2025-8885 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-11777841...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.20.2 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

io.quarkus/quarkus-vertx: Quarkus potential data leak

A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be...

io.quarkus/quarkus-vertx: Quarkus potential data leak

A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError...

io.quarkus/quarkus-vertx: Quarkus potential data leak

A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be...

Security Bulletin: Vulnerabilities in Quarkus-HTTP affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Quarkus-HTTP has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-12397 DESCRIPTION: A...

Security Bulletin: Vulnerabilities in quarkus-resteasy affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in quarkus-resteasy has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-1634 DESCRIPTION: ...

ai.h2o:h2o-orc-parser (>=3.10.0.5 <=3.10.3.6), ai.hypergraph:kaliningraph-jvm (=0.2.1) +4770 more potentially affected by CVE-2025-50059 via org.graalvm.sdk:graal-sdk (>=22.0.0 <=24.0.1)

org.graalvm.sdk:graal-sdk MAVEN version =22.0.0, =3.10.0.5, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =1.1.0 and more Source cves: CVE-2025-50059 Source advisory: SNYK:JAVA-ORGGRAALVMSDK-11998135ht...

ai.swim:swim-js (=3.10.0), ai.swim:swim-vm (=3.10.0) +3052 more potentially affected by CVE-2025-50106 via org.graalvm.sdk:graal-sdk (>=19.0.0 <=21.0.0.2)

org.graalvm.sdk:graal-sdk MAVEN version =19.0.0, =0.0.1, =0.1.5, =0.1.5, =0.0.2, =0.0.2, =1.5.1, =1.0.0, =1.0.2, =1.0.0, =1.0.2, =1.0.2, =1.1.4 and more Source cves: CVE-2025-50106 Source advisory: SNYK:JAVA-ORGGRAALVMSDK-11998131...

ai.h2o:h2o-orc-parser (>=3.10.0.5 <=3.10.3.6), ai.hypergraph:kaliningraph-jvm (=0.2.1) +4770 more potentially affected by CVE-2025-30749 via org.graalvm.sdk:graal-sdk (>=22.0.0 <=24.0.1)

org.graalvm.sdk:graal-sdk MAVEN version =22.0.0, =3.10.0.5, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =1.1.0 and more Source cves: CVE-2025-30749 Source advisory: SNYK:JAVA-ORGGRAALVMSDK-11998139ht...

ai.h2o:h2o-orc-parser (>=3.10.0.5 <=3.10.3.6), ai.hypergraph:kaliningraph-jvm (=0.2.1) +4770 more potentially affected by CVE-2025-30754 via org.graalvm.sdk:graal-sdk (>=22.0.0 <=24.0.1)

org.graalvm.sdk:graal-sdk MAVEN version =22.0.0, =3.10.0.5, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =0.8.38, =1.1.0 and more Source cves: CVE-2025-30754 Source advisory: SNYK:JAVA-ORGGRAALVMSDK-11023285ht...

io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError...

Exposure of Resource to Wrong Sphere

Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the duplicated context process. An attacker can access sensitive data from another transaction by triggering the duplication of an already duplicated context. Note: Duplicating a duplicated conte...

CVE-2025-49574

Quarkus is a Cloud Native, Linux Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation...

CVE-2025-49574 Quarkus potential data leak when duplicating a duplicated context

Quarkus is a Cloud Native, Linux Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation...

CVE-2025-49574

CVE-2025-49574 affects Quarkus (Java) where data from a duplicated Vert.x context may leak into another transaction due to duplicating a duplicated context. Public details indicate this impacts versions prior to 3.24.1, 3.20.2, and 3.15.6, with patches provided in those versions. Remediation is t...