Blog Quarkus 3.27.5.3 released - LTS emergency release

September 22, 2026 #release

Quarkus 3.27.5.3 released - LTS emergency release

Jan Martiška avatar Jan Martiška

Today, we released Quarkus 3.27.5.3, an emergency release for the 3.27 LTS stream.

This release fixes the following CVEs:

  • CVE-2026-77874 - Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

  • CVE-2026-19611 - WildFly Elytron: Password keyspace reduction via NFKC fullwidth folding

  • CVE-2026-81829 - SmallRye JWT: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver

  • CVE-2026-87742 - Quarkus WebSockets Next: Denial of Service (OOM) via unbounded message buffering

  • CVE-2026-87743 - Quarkus Vert.x HTTP: Authorization bypass via path normalization discrepancy in Quarkus HTTP security

  • CVE-2026-87825 - zstd-jni: Data corruption or denial of service via use-after-free vulnerability

  • CVE-2026-87877 - zstd-jni: Use-after-free vulnerability allows memory corruption and denial of service

  • CVE-2026-87795 - zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service

  • CVE-2026-87824 - zstd-jni: Denial of Service via out-of-bounds read in Zstd.trainFromBufferDirect

  • CVE-2026-89046 - zstd-jni: Information disclosure or denial of service via out-of-bounds read

  • CVE-2026-87823 - zstd-jni: Denial of Service or information disclosure via out-of-bounds read

  • CVE-2026-90560 - zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress

  • CVE-2026-90852 - zstd-jni: Remote use-after-free vulnerability in dictionary sharing

  • CVE-2026-89045 - zstd-jni: Denial of Service via negative length parameter

  • CVE-2026-84939 - Apache FreeMarker: Path traversal via malformed locale identifier

  • CVE-2026-94449 - Quarkus SmallRye Fault Tolerance: Memory leak in @ApplyGuard leads to Denial of Service

  • CVE-2026-93491 - Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue

  • CVE-2026-93558 - Netty: Unbounded per-connection queue growth in WebSocketServerExtensionHandler leads to Denial of Service

  • CVE-2026-93564 - Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak

  • CVE-2026-93565 - Netty: RtspDecoder method-token smuggling via trailing control byte

  • CVE-2026-93567 - Netty: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

  • CVE-2026-93568 - Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests

  • CVE-2026-93569 - Netty: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

  • CVE-2026-93492 - Netty: HTTP/2 HpackEncoder Denial of Service with large table size

  • CVE-2026-93562 - Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling

  • CVE-2026-93566 - Netty: HTTP request smuggling due to control characters in the chunk-size line

  • CVE-2026-93573 - Netty: Split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling

  • CVE-2026-93574 - Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing

  • CVE-2026-93579 - Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)

It also fixes a native image regression in the RabbitMQ extension.

3.27 をすでに使用している方にとっては、安全にアップグレードできます。

Update

Quarkus 3.27 に更新するには、Quarkus CLI の最新バージョンに更新してから、以下を実行することをお勧めします。

quarkus update --stream=3.27

quarkus update は、Quarkus の任意のバージョン (2.x を含む) から Quarkus 3.27 にアプリケーションを更新できます。

完全な変更履歴

You can get the full changelog of 3.27.5.3 on GitHub.

参加のお誘い

私達は皆様からのフィードバックに重きを置いています。バグ報告、改善要望を是非お願いします。一緒に素晴らしいものを作り上げていきましょう!

Quarkusユーザーの場合でも、単に興味を持っているだけの場合でも、恥ずかしがらずにコミュニティに参加して下さい!:

Quarkus is open. All dependencies of this project are available under the Apache Software License 2.0 or compatible license. CC by 3.0

This website was built with Roq on Quarkus, is hosted on GitHub Pages and is completely open source. If you want to make it better, fork the website and show us what you’ve got.

ナビゲーション
フォローする
ヘルプ
言語
Quarkusはコミュニティプロジェクトで構成されています
Copyright © Quarkus. All rights reserved. For details on our trademarks, please visit our Trademark Policy and Trademark List. Trademarks of third parties are owned by their respective holders and their mention here does not suggest any endorsement or association.