Red Hat Build Of Quarkus vulnerabilities

18 CVEs affecting Red Hat Build Of Quarkus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93432, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-5971, published 2024-07-08. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not…
CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-1023, published 2024-03-27. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
CVE-2023-4639, published 2024-11-17. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to…
CVE-2024-1300, published 2024-04-02. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate…
CVE-2025-2240, published 2025-03-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates…
CVE-2026-5598, published 2026-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue…
CVE-2025-1634, published 2025-02-26. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly,…
CVE-2024-1726, published 2024-04-25. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed…

Latest

CVE-2026-93432, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard…
CVE-2026-10832, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding…
CVE-2026-81829, published 2026-09-17. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured,…
CVE-2026-76763, published 2026-08-31. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this…
CVE-2024-4027, published 2026-01-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names.…