Red Hat Red Hat build of Quarkus 3.33.4.redhat
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-87744 | fixed in 3.33.4.redhat-00004 | Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-94451 | fixed in 3.33.4.redhat-00004 | Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort par… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-94449 | fixed in 3.33.4.redhat-00004 | Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service | HIGH 7.5 | 0.6 % | ||
| CVE-2026-93432 | fixed in 3.33.4.redhat-00004 | Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-89058 | fixed in 6.2.19.Final-redhat-00003 | Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config | HIGH 7.4 | 0.3 % | ||
| CVE-2026-89059 | fixed in 6.2.19.Final-redhat-00003 | Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) | HIGH 7.5 | 0.9 % |