Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP3 security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CVE-2026-39852

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP...

CVE-2026-39852: Incorrect Authorization

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP...

GHSA-RC95-PCM8-65V9 Quarkus has Authentication/Authorization bypasses

Quarkus version 3.32.4 is vulnerable to an authorization bypass issue GHSL-2026-099, in which semicolons matrix parameters in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources. Unauthenticated or lower-privileged users can...

EUVD-2023-0730

Malicious code in bioql PyPI...

EUVD-2022-15978

Malicious code in bioql PyPI...

EUVD-2024-1255

Malicious code in bioql PyPI...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the shared instance used in field injection without a CDI scope. An attacker can manipulate request data, impersonate users, or access sensitive information by exploiting the leakage of...

RESTEasy Reactive Java DoS

The vulnerability of the RESTEasy Reactive Java framework in Quarkus is related to improper permission storage. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

io.quarkiverse.jef:quarkus-java-embedded-framework-deployment (0.0.1), io.quarkus:quarkus-hibernate-reactive-rest-data-panache-deployment (2.12.0.final) +22 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.12.0.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.12.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-csrf-reactive (2.13.5.final), io.quarkus:quarkus-csrf-reactive-deployment (2.13.5.final) +47 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (2.13.5.final)

io.quarkus:quarkus-resteasy-reactive-common MAVEN version 2.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - io.quarkus:quarkus-csrf-reactive 2.13.5.final -...

io.quarkus:quarkus-csrf-reactive-deployment (2.16.7.final), io.quarkus:quarkus-hibernate-reactive-rest-data-panache-deployment (2.16.7.final) +22 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.16.7.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.16.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: - io.quarkus:quarkus-csrf-reactive-deployment...

io.quarkus:quarkus-csrf-reactive-deployment (2.13.7.final), io.quarkus:quarkus-hibernate-reactive-rest-data-panache-deployment (2.13.7.final) +22 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.13.7.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.13.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: - io.quarkus:quarkus-csrf-reactive-deployment...

io.quarkus:quarkus-csrf-reactive-deployment (2.16.1.final), io.quarkus:quarkus-hibernate-reactive-rest-data-panache-deployment (2.16.1.final) +22 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.16.1.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.16.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: - io.quarkus:quarkus-csrf-reactive-deployment...

io.automatiko.quarkus:automatiko-operator-deployment (0.15.0), io.automatiko.quarkus:automatiko-service-deployment (0.15.0) +24 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.8.1.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.automatiko.quarkus:automatiko-operator-deployment (0.21.0), io.automatiko.quarkus:automatiko-service-deployment (0.21.0) +25 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.15.1.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.15.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.5.0.cr1), io.quarkus:quarkus-oidc-client-reactive-filter-deployment (2.5.0.cr1) +12 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.5.0.cr1)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.0.0.final), io.quarkus:quarkus-oidc-client-reactive-filter-deployment (2.0.0.final) +9 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.0.0.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive (2.1.0.cr1), io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.1.0.cr1) +25 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (2.1.0.cr1)

io.quarkus:quarkus-resteasy-reactive-common MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - io.quarkus:quarkus-jaxrs-client-reactive 2.1.0.cr1 -...

io.quarkus:quarkus-hibernate-reactive-rest-data-panache-deployment (2.10.4.final), io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.10.4.final) +22 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.10.4.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.10.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...