Quarkus vulnerabilities

Products

• Quarkus 49

Newest

• quarkus quarkus-qute, red hat build of apache camel 3.33.3.sp1, build of apache camel 4 for quarkus 3 +3 more +5 more Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine CVE-2026-12894 8.8 HighAugust 31, 2026
• quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 more Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVE-2026-50559 Fix available 7.5 HighJune 19, 2026
• quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 more Quarkus authorization bypass via semicolon path normalization inconsistency CVE-2026-39852 Fix available 8.8 HighMay 4, 2026
• quarkus Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write CVE-2025-66560 Fix available 5.9 MediumJanuary 7, 2026
• quarkus, red hat build of quarkus +1 more Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass CVE-2024-12225 9.1 CriticalMay 6, 2025
• quarkus, red hat build of optaplanner 8, build of quarkus 2.13.9.final +4 more +6 more Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations. CVE-2023-6267 Fix available 8.6 HighJanuary 25, 2024
• quarkus, red hat build of quarkus, build of quarkus 2.13.9 +1 more +3 more Quarkus: graphql operations over websockets bypass CVE-2023-6394 Fix available 7.4 HighDecember 9, 2023
• quarkus Quarkus: build env information disclosure via gradle plugin CVE-2023-5720 7.7 HighNovember 15, 2023
• quarkus, red hat build of quarkus 2.13.8.final, rhint service registry 2.5.4 ga +2 more Quarkus-oidc: id and access tokens leak via the authorization code flow CVE-2023-1584 Fix available 7.5 HighOctober 4, 2023
• quarkus, red hat openshift serverless 1 on rhel 8, build of optaplanner 8 +20 more +22 more Quarkus: http security policy bypass CVE-2023-4853 Fix available 8.1 HighSeptember 20, 2023
• quarkus RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions CVE-2023-0481 Fix available 3.3 LowFebruary 24, 2023
• quarkus, redhat build of quarkus +1 more Cross-site Scripting in Quarkus CVE-2023-0044 Fix available 6.1 MediumFebruary 23, 2023
• quarkus Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed CVE-2022-4147 Fix available 7.5 HighDecember 6, 2022
• quarkus, redhat build of quarkus +1 more Code injection in quarkus dev ui config editor CVE-2022-4116 Fix available EPSS 32.5% 9.8 CriticalNovember 22, 2022
• fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more Uncontrolled Resource Consumption in FasterXML jackson-databind CVE-2022-42004 Fix available 7.5 HighOctober 2, 2022
• fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 more Uncontrolled Resource Consumption in Jackson-databind CVE-2022-42003 Fix available 7.5 HighOctober 2, 2022
• quarkus Quarkus does not terminate HTTP requests header context CVE-2022-2466 Public exploitFix available 9.8 CriticalAugust 31, 2022
• quarkus A flaw was found in Quarkus. The state and potentially associated permissions can leak from one... CVE-2022-0981 8.8 HighMarch 23, 2022
• postgresql jdbc driver, debian linux, fedoraproject fedora +1 more +3 more Unchecked Class Instantiation when providing Plugin Classes CVE-2022-21724 Fix available 7.0 HighFebruary 2, 2022
• oracle mysql connectors, quarkus +1 more Improper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java CVE-2022-21363 Fix available 6.6 MediumJanuary 19, 2022
• netty, debian linux, netapp oncommand workflow automation +15 more +17 more HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling CVE-2021-43797 Fix available 6.5 MediumDecember 9, 2021
• oracle mysql connectors, communications cloud native core console, communications cloud native core network slice selection function +3 more +5 more Incorrect Authorization in MySQL Connector Java CVE-2021-2471 Public exploitFix available 5.9 MediumOctober 20, 2021
• apache kafka, oracle communications brm - elastic charging engine, communications cloud native core policy +5 more +7 more Timing Attack Vulnerability for Apache Kafka Connect and Clients CVE-2021-38153 Fix available 5.9 MediumSeptember 22, 2021
• debian linux, netapp oncommand insight, netty +9 more +11 more SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way CVE-2021-37137 Fix available 7.5 HighSeptember 9, 2021
• debian linux, netapp oncommand insight, netty +16 more +18 more Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 Fix available 7.5 HighSeptember 9, 2021
• jhy jsoup, netapp management services for element software and netapp hci, oracle banking trade finance +13 more +15 more Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions CVE-2021-37714 Fix available 7.5 HighAugust 18, 2021
• redhat wildfly elytron, quarkus, redhat build of quarkus +11 more +13 more Observable Discrepancy in Wildfly Elytron CVE-2021-3642 Fix available 5.3 MediumAugust 5, 2021
• eclipse jakarta expression language, the eclipse foundation jakarta expression language implementation, oracle communications cloud native core policy +2 more +4 more Improper Input Validation in Jakarta Expression Language CVE-2021-28170 Fix available 5.3 MediumMay 26, 2021
• red hat resteasy, quarkus +1 more Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy CVE-2020-25724 Fix available 4.3 MediumMay 26, 2021
• apache maven, oracle financial services analytical applications infrastructure, goldengate big data and application adapters +1 more +3 more block repositories using http by default CVE-2021-26291 Public exploitFix available 9.1 CriticalApril 23, 2021
• gradle, quarkus +1 more Repository content filters do not work in Settings pluginManagement CVE-2021-29427 Public exploitFix available 8.0 HighApril 13, 2021
• gradle, quarkus +1 more Local privilege escalation through system temporary directory CVE-2021-29428 Fix available 8.8 HighApril 13, 2021
• gradle, quarkus +1 more Information disclosure through temporary directory permissions CVE-2021-29429 Fix available 4.0 MediumApril 12, 2021
• netty, debian linux, netapp oncommand api services +15 more +17 more Possible request smuggling in HTTP/2 due missing validation of content-length CVE-2021-21409 Fix available 5.9 MediumMarch 30, 2021
• red hat resteasy, netapp oncommand insight, oracle communications cloud native core console +1 more +3 more Exposure of class information in RESTEasy CVE-2021-20289 Fix available 5.3 MediumMarch 26, 2021
• netty io.netty:netty-codec-http2, netty, apache kudu +6 more +8 more Possible request smuggling in HTTP/2 due missing validation CVE-2021-21295 Fix available EPSS 18.9% 5.9 MediumMarch 9, 2021
• mongodb java driver, mongodb inc. mongo-java-driver, mongodb-driver +3 more +5 more MongoDB Java driver client-side field level encryption not verifying KMS host name CVE-2021-20328 Fix available 6.4 MediumFebruary 25, 2021
• fasterxml jackson-dataformats-binary, oracle weblogic server, quarkus +2 more Denial of Service (DoS) CVE-2020-28491 Fix available 7.5 HighFebruary 18, 2021
• netty, debian linux, netapp active iq unified manager +10 more +12 more Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files CVE-2021-21290 Fix available 6.2 MediumFebruary 8, 2021
• google guava, netapp active iq unified manager, oracle commerce guided search +10 more +12 more Temp directory permission issue in Guava CVE-2020-8908 Fix available 3.3 LowDecember 10, 2020
• hibernate orm, debian linux, oracle communications cloud native core console +2 more +4 more SQL injection in hibernate-core CVE-2020-25638 Fix available 7.4 HighDecember 2, 2020
• apache iotdb, fasterxml jackson-databind, fedoraproject fedora +36 more +38 more XML External Entity (XXE) Injection in Jackson Databind CVE-2020-25649 Fix available EPSS 17.7% 7.5 HighOctober 14, 2020
• apache httpclient, netapp active iq unified manager, snapcenter +14 more +16 more Cross-site scripting in Apache HttpClient CVE-2020-13956 Fix available 5.3 MediumOctober 10, 2020
• redhat resteasy, quarkus, red hat resteasy-client +2 more Generation of Error Message Containing Sensitive Information in RESTEasy client CVE-2020-25633 Fix available 5.3 MediumSeptember 18, 2020
• hibernate orm, quarkus, redhat build of quarkus +7 more +9 more SQL Injection in Hibernate ORM CVE-2019-14900 Public exploitFix available 6.5 MediumJuly 6, 2020
• postgresql jdbc driver, debian linux, fedoraproject fedora +2 more +4 more Improper Restriction of XML External Entity Reference CVE-2020-13692 Fix available 7.7 HighJune 4, 2020
• keycloak, quarkus, redhat decision manager +4 more +6 more Improper Input Validation in Keycloak CVE-2020-1714 Fix available 7.5 HighMay 13, 2020
• redhat hibernate validator, hibernate hibernate-validator, ibm websphere application server +5 more +7 more Improper Input Validation in Hibernate Validator CVE-2020-10693 Fix available 5.3 MediumMay 6, 2020
• [unknown] keycloak, quarkus +1 more Improper Restriction of Rendered UI Layers or Frames in Keycloak CVE-2020-1728 4.8 MediumApril 6, 2020
• snakeyaml project snakeyaml, fedoraproject fedora, oracle peoplesoft enterprise pt peopletools +1 more +3 more SnakeYAML Entity Expansion during load operation CVE-2017-18640 Fix available EPSS 26.7% 7.5 HighDecember 12, 2019