Blog Quarkus 3.27.6 released - LTS maintenance release

September 30, 2026 #release

Quarkus 3.27.6 released - LTS maintenance release

Jan Martiška avatar Jan Martiška

Today, we released Quarkus 3.27.6, our next maintenance release for the 3.27 LTS stream.

This release contains bugfixes, documentation updates, and security fixes.

3.27 をすでに使用している方にとっては、安全にアップグレードできます。

Please note that this is planned to be the last update to 3.27. Anybody still on 3.27 is advised to look into upgrading to 3.33 or 3.40 (the next LTS) soon.

Security fixes

This release fixes the following CVEs:

Quarkus and direct dependencies

  • CVE-2026-89407 - FasterXML jackson-core: Denial of Service via quadratic regex backtracking in number validation

  • CVE-2026-89425 - FasterXML jackson-core: Denial of Service via unbounded error-token accumulation in UTF8DataInputJsonParser

  • CVE-2026-91777 - FasterXML jackson-databind: Denial of Service via quadratic-time forward-reference resolution for @JsonIdentityInfo

  • CVE-2026-91776 - FasterXML jackson-databind: Denial of Service via unbounded deserializer cache growth for unrecognized polymorphic type IDs

  • CVE-2026-84939 - Apache FreeMarker: Path traversal via malformed locale identifier

  • CVE-2026-94449 - Quarkus SmallRye Fault Tolerance: Memory leak in @ApplyGuard leads to Denial of Service

  • CVE-2026-82617 - Apache OpenNLP: Denial of Service via super-linear regex backtracking in built-in name finders

  • CVE-2026-68497 - Jackson-databind: Denial of Service via unbounded number parsing for Duration/XMLGregorianCalendar

  • CVE-2026-89059 - RESTEasy: Denial of Service via unbounded memory allocation in IIOImageProvider

  • CVE-2026-93432 - Quarkus Qute: Cross-Site Scripting via missing content-type propagation in {#eval} sub-templates

  • CVE-2026-59949 - LZ4 Java: Denial of Service via native XXHash crash on invalid byte array ranges

  • CVE-2026-61700 - MariaDB Connector/J: allowLocalInfile=false bypass via server-initiated LOCAL INFILE request

  • CVE-2026-55856 - MariaDB Connector/J: Cleartext password disclosure via MITM on the initial handshake

  • CVE-2026-55857 - MariaDB Connector/J: Cleartext transmission of credentials during PAM authentication

  • CVE-2026-55858 - MariaDB Connector/J: Data corruption via incorrect character set handling after a mid-session charset change

プラットフォームの更新

This release includes Quarkus CXF 3.27.2.

Update

Quarkus 3.27 に更新するには、Quarkus CLI の最新バージョンに更新してから、以下を実行することをお勧めします。

quarkus update --stream=3.27

quarkus update は、Quarkus の任意のバージョン (2.x を含む) から Quarkus 3.27 にアプリケーションを更新できます。

完全な変更履歴

You can get the full changelog of 3.27.6 on GitHub.

参加のお誘い

私達は皆様からのフィードバックに重きを置いています。バグ報告、改善要望を是非お願いします。一緒に素晴らしいものを作り上げていきましょう!

Quarkusユーザーの場合でも、単に興味を持っているだけの場合でも、恥ずかしがらずにコミュニティに参加して下さい!:

Quarkus is open. All dependencies of this project are available under the Apache Software License 2.0 or compatible license. CC by 3.0

This website was built with Roq on Quarkus, is hosted on GitHub Pages and is completely open source. If you want to make it better, fork the website and show us what you’ve got.

ナビゲーション
フォローする
ヘルプ
言語
Quarkusはコミュニティプロジェクトで構成されています
Copyright © Quarkus. All rights reserved. For details on our trademarks, please visit our Trademark Policy and Trademark List. Trademarks of third parties are owned by their respective holders and their mention here does not suggest any endorsement or association.