Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6 release and security update

The Red Hat build of Quarkus 3.27.6 release includes fixes for multiple security vulnerabilities identified by CVEs such as CVE-2026-91777 (DoS via quadratic forward-reference completion in jackson-databind), CVE-2026-19032 (uncontrolled URI scheme resolution in jackson-databind path deserialization), CVE-2026-88032 (DoS via use-after-free in MongoDB Java Driver client-side encryption), CVE-2026-89058 (CORS filter reflecting arbitrary origin with credentials in RESTEasy), CVE-2026-93432 (XSS and JSON injection via Qute {#eval} section), CVE-2026-55856 (cleartext password disclosure in MariaDB Connector/J), among others. The advisory details a broad range of issues including denial of service, information disclosure, path traversal, memory leaks, and authentication bypass across multiple libraries and components integrated into Quarkus. The update also includes various dependency bumps and security improvements.

The vulnerabilities fixed in this update could allow attackers to cause denial of service conditions, disclose sensitive information, perform path traversal attacks, execute cross-site scripting, bypass authentication checks, and cause memory leaks. These issues affect critical components such as JSON processing libraries, database connectors, REST frameworks, and template engines, potentially impacting the confidentiality, integrity, and availability of applications using the affected Quarkus build.

A security update to Red Hat build of Quarkus version 3.27.6 is available and includes fixes for all listed vulnerabilities. Users should apply this update promptly to mitigate the security risks. Before applying this update, ensure all previously released relevant errata are applied. Follow Red Hat's official guidance for applying updates as detailed in their advisory (https://access.redhat.com/errata/RHSA-2026:83082 and https://access.redhat.com/articles/11258).