This Red Hat security advisory (RHSA-2026:26017) addresses 14 distinct vulnerabilities in the Red Hat build of Quarkus 3.33.2.SP1. The vulnerabilities include authentication and authorization bypass via advanced path normalization (CVE-2026-50559), denial of service attacks through TLS handshake with wildcard server names (CVE-2026-6860), malformed HAProxy message handling (CVE-2026-44893), resource leaks causing denial of service (CVE-2026-48043), memory leaks from crafted PROXY protocol headers (CVE-2026-48059), improper trust manager handling leading to hostname verification bypass (CVE-2026-50010), data manipulation via HTTP request boundary confusion (CVE-2026-50020), DNS cache poisoning via predictable transaction IDs (CVE-2026-45673), and others related to IPv6 subnet rule bypass, insufficient bailiwick validation, and HTTP/2 denial of service conditions. The update upgrades underlying dependencies Netty and Vertx to fixed versions to mitigate these vulnerabilities. No known exploits in the wild have been reported. The advisory recommends applying this update after ensuring all previous errata are applied.

The vulnerabilities collectively impact authentication and authorization mechanisms, potentially allowing bypasses; enable denial of service attacks through malformed or crafted network messages and resource exhaustion; allow information disclosure and data manipulation via improper DNS record validation; and permit hostname verification bypass. These issues could affect the security posture of applications using the affected Quarkus build, potentially leading to service disruption or unauthorized access if exploited.

A security update for Red Hat build of Quarkus 3.33.2.SP1 is available and should be applied. This update includes fixes for all listed vulnerabilities by upgrading Netty to 4.1.135.Final and Vertx to 4.5.28. Before applying this update, ensure all previously released relevant errata have been installed. Follow Red Hat's official guidance for applying the update as detailed in their advisory and documentation. No additional mitigation steps are indicated beyond applying the official update.