Red Hat Security Advisory: Red Hat build of Quarkus 3.33.4 release and security update

This Red Hat security advisory covers the release of Red Hat build of Quarkus 3.33.4 which includes fixes for numerous CVEs affecting multiple components integrated within Quarkus. Notable vulnerabilities include denial of service via quadratic forward-reference completion and unbounded cache growth in jackson-databind, path traversal via incomplete type validation, uncontrolled URI scheme resolution in path deserialization, and cross-site scripting via Qute template engine evaluation. Other fixes address memory leaks, information disclosure, missing authorization, and certificate validation bypass. The update consolidates patches for these issues to improve security and stability of the Quarkus runtime environment.

The vulnerabilities fixed in this update can lead to denial of service, information disclosure, cross-site scripting, path traversal, memory leaks, and certificate validation bypass in applications using the affected Quarkus components. These issues could allow attackers to disrupt service availability, access sensitive data, or execute malicious scripts. The impact is rated as high due to the range of security issues addressed and their potential to affect application integrity and confidentiality.

A security update to Red Hat build of Quarkus 3.33.4 is available that addresses these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Refer to the official Red Hat advisory RHSA-2026:83520 for detailed instructions on applying the update. No additional mitigation steps are indicated beyond applying the official patch.