Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

CVE-2026-19651

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. Mitigation...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6796 more potentially affected by CVE-2026-59314 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59314 Source advisory: MEND:CVE-2026-59314...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6796 more potentially affected by CVE-2026-59281 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59281 Source advisory: MEND:CVE-2026-59281...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6796 more potentially affected by CVE-2026-47889 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47889 Source advisory: MEND:CVE-2026-47889...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6796 more potentially affected by CVE-2026-47885 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47885 Source advisory: MEND:CVE-2026-47885...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6796 more potentially affected by CVE-2026-47883 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47883 Source advisory: MEND:CVE-2026-47883...

K000163048: Spring web services vulnerability CVE-2026-40998

Security Advisory Description Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6837 more potentially affected by CVE-2026-59281 via org.springframework:spring-web (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59281 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267078...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +15236 more potentially affected by CVE-2026-47889 via org.springframework:spring-web (>=6.2.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.5.7 and more Source cves: CVE-2026-47889 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267079...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6837 more potentially affected by CVE-2026-59314 via org.springframework:spring-web (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59314 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267076...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +20410 more potentially affected by CVE-2026-47885 via org.springframework:spring-web (>=6.1.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.1.4 and more Source cves: CVE-2026-47885 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267077...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...