Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP1 security update
This release of Red Hat build of Quarkus 3.27.4.SP1 includes the following CVE fixes: * quarkus-vertx-http: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities [quarkus-3.27] (CVE-2026-50559) * vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name [quarkus-3.27] (CVE-2026-6860) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [quarkus-3.27] (CVE-2026-44249) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message [quarkus-3.27] (CVE-2026-44893) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak [quarkus-3.27] (CVE-2026-48043) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers [quarkus-3.27] (CVE-2026-48059) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records [quarkus-3.27] (CVE-2026-47691) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [quarkus-3.27] (CVE-2026-50010) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation [quarkus-3.27] (CVE-2026-45674) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [quarkus-3.27] (CVE-2026-45416) * netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling [quarkus-3.27] (CVE-2026-50560) * netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams [quarkus-3.27] (CVE-2026-47244) * netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder [quarkus-3.27] (CVE-2026-50020) * netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs [quarkus-3.27] (CVE-2026-45673) For more information, see the release notes page listed in the References section.
AI Analysis
Technical Summary
This security advisory for Red Hat build of Keycloak 26.6.4 details fixes for multiple vulnerabilities including CVE-2026-6860 (Denial of Service via TLS handshake with wildcard server name in eclipse-vertx/vert.x), information disclosure through CORS header injection and filesystem probing, privilege escalation via oversized JWT tokens, cross-site scripting via URI validation bypass, and authorization bypasses via incorrect URI comparison and UMA permission ticket bypass. The vulnerabilities span improper access control, security restriction bypass, replay attacks on refresh tokens, and denial of service via malformed requests. The advisory aggregates 14 CVEs and additional related CVEs, indicating a comprehensive security update for the product.
Potential Impact
The vulnerabilities fixed in this update could allow attackers to disclose sensitive information, escalate privileges to administrative levels, bypass authentication and authorization controls, cause denial of service conditions, and manipulate token-based authentication flows. These impacts threaten the confidentiality, integrity, and availability of systems using Red Hat build of Keycloak for authentication and single sign-on services.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.6.4 that address these vulnerabilities. Users should apply the update from the Red Hat Customer Portal to remediate these issues. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are indicated beyond applying the official update.
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP1 security update
Description
This release of Red Hat build of Quarkus 3.27.4.SP1 includes the following CVE fixes: * quarkus-vertx-http: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities [quarkus-3.27] (CVE-2026-50559) * vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name [quarkus-3.27] (CVE-2026-6860) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [quarkus-3.27] (CVE-2026-44249) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message [quarkus-3.27] (CVE-2026-44893) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak [quarkus-3.27] (CVE-2026-48043) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers [quarkus-3.27] (CVE-2026-48059) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records [quarkus-3.27] (CVE-2026-47691) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [quarkus-3.27] (CVE-2026-50010) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation [quarkus-3.27] (CVE-2026-45674) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [quarkus-3.27] (CVE-2026-45416) * netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling [quarkus-3.27] (CVE-2026-50560) * netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams [quarkus-3.27] (CVE-2026-47244) * netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder [quarkus-3.27] (CVE-2026-50020) * netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs [quarkus-3.27] (CVE-2026-45673) For more information, see the release notes page listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This security advisory for Red Hat build of Keycloak 26.6.4 details fixes for multiple vulnerabilities including CVE-2026-6860 (Denial of Service via TLS handshake with wildcard server name in eclipse-vertx/vert.x), information disclosure through CORS header injection and filesystem probing, privilege escalation via oversized JWT tokens, cross-site scripting via URI validation bypass, and authorization bypasses via incorrect URI comparison and UMA permission ticket bypass. The vulnerabilities span improper access control, security restriction bypass, replay attacks on refresh tokens, and denial of service via malformed requests. The advisory aggregates 14 CVEs and additional related CVEs, indicating a comprehensive security update for the product.
Potential Impact
The vulnerabilities fixed in this update could allow attackers to disclose sensitive information, escalate privileges to administrative levels, bypass authentication and authorization controls, cause denial of service conditions, and manipulate token-based authentication flows. These impacts threaten the confidentiality, integrity, and availability of systems using Red Hat build of Keycloak for authentication and single sign-on services.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.6.4 that address these vulnerabilities. Users should apply the update from the Red Hat Customer Portal to remediate these issues. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:26018
- Cve Count
- 14
- Additional Cves
- ["CVE-2026-44249","CVE-2026-44893","CVE-2026-45416","CVE-2026-45673","CVE-2026-45674","CVE-2026-47244","CVE-2026-47691","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50020","CVE-2026-50559","CVE-2026-50560"]
- Cvss Version
- null
Threat ID: 6a343cacf198dc38c14e22ee
Added to database: 06/18/2026, 18:45:00 UTC
Last enriched: 07/30/2026, 15:32:52 UTC
Last updated: 07/31/2026, 19:24:48 UTC
Views: 202
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.