The Red Hat build of Quarkus 3.27.5 release includes fixes for several security vulnerabilities: CVE-2026-53712 addresses an authentication downgrade via TLS man-in-the-middle attack in SCRAM libraries; CVE-2026-8484 fixes a heap buffer overflow in Jansi that can lead to denial of service; CVE-2026-54291 resolves a man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade in the PostgreSQL JDBC driver; and CVE-2026-56624 mitigates unauthorized command execution in Apache MINA SSHD due to improper certificate validation. The update consolidates these fixes and is rated as important by Red Hat Product Security.

Exploitation of these vulnerabilities could allow attackers to downgrade authentication protocols, bypass man-in-the-middle protections, cause denial of service via heap buffer overflow, or execute unauthorized commands due to improper certificate validation. These impacts can compromise the security and availability of applications using affected versions of Red Hat build of Quarkus prior to 3.27.5.

Red Hat has released version 3.27.5 of its build of Quarkus which includes fixes for the listed vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated beyond applying the official update.