Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus Core Security, SmallRye JWT, Hibernate and WebSockets.next Vulnerability Details CVEID:CVE-2026-87743 DESCRIPTION: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

CVE-2026-81829 is a same-origin SSRF vulnerability in SmallRye JWT 's AwsAlbKeyResolver , used by applications (e.g., Quarkus) to verify JWTs signed by AWS Application Load Balancers. The root cause is that the resolver constructs the key-fetch URL by directly concatenating the attacker-controlle...

EUVD-2026-81617

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

CVE-2026-81829

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

PT-2026-94341

Name of the Vulnerable Software and Affected Versions SmallRye JWT affected versions not specified Description A flaw exists in the AwsAlbKeyResolver of SmallRye JWT, used for verifying JSON Web Tokens signed by AWS Application Load Balancers. When the AWS ALB key provider is active, the resolver...

CVE-2026-81829: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...

io.quarkus:quarkus-mailer (1.3.3.final), io.quarkus:quarkus-mailer-deployment (1.3.3.final) +17 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.3.3.final)

io.quarkus:quarkus-vertx MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 1.3.3.final - io.quarkus:quarkus-mailer-deployment 1.3.3.final -...

io.quarkus:quarkus-mailer (1.1.0.cr1), io.quarkus:quarkus-mailer-deployment (1.1.0.cr1) +17 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.1.0.cr1)

io.quarkus:quarkus-vertx MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 1.1.0.cr1 - io.quarkus:quarkus-mailer-deployment 1.1.0.cr1 -...

io.quarkus:quarkus-mailer (1.3.2.final), io.quarkus:quarkus-mailer-deployment (1.3.2.final) +34 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.3.2.final)

io.quarkus:quarkus-vertx MAVEN version 1.3.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 1.3.2.final - io.quarkus:quarkus-mailer-deployment 1.3.2.final -...

io.quarkus:quarkus-mailer (0.25.0), io.quarkus:quarkus-mailer-deployment (0.25.0) +19 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (0.25.0)

io.quarkus:quarkus-vertx MAVEN version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 0.25.0 - io.quarkus:quarkus-mailer-deployment 0.25.0 -...

io.quarkus:quarkus-mailer (1.1.1.final), io.quarkus:quarkus-mailer-deployment (1.1.1.final) +17 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.1.1.final)

io.quarkus:quarkus-vertx MAVEN version 1.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 1.1.1.final - io.quarkus:quarkus-mailer-deployment 1.1.1.final -...

com.datastax.oss.quarkus:cassandra-quarkus-integration-tests (>=1.0.0-alpha2, <=1.0.0-alpha3), io.backpackcloud:fakeomatic (>=0.1.0, <=0.2.1) +39 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.5.0.final)

io.quarkus:quarkus-vertx MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-integration-tests =1.0.0-alpha2, =0.1.0, =0.2.1 -...

io.quarkus:quarkus-mailer (1.3.0.alpha1), io.quarkus:quarkus-mailer-deployment (1.3.0.alpha1) +17 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.3.0.alpha1)

io.quarkus:quarkus-vertx MAVEN version 1.3.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-mailer 1.3.0.alpha1 - io.quarkus:quarkus-mailer-deployment 1.3.0.alpha1 -...

io.quarkus:quarkus-grpc (1.10.5.final), io.quarkus:quarkus-grpc-common (1.10.5.final) +31 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.10.5.final)

io.quarkus:quarkus-vertx MAVEN version 1.10.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-grpc 1.10.5.final - io.quarkus:quarkus-grpc-common 1.10.5.final -...