Blog Quarkus 3.33.4 released - LTS maintenance release

September 30, 2026 #release

Quarkus 3.33.4 released - LTS maintenance release

Jan Martiška avatar Jan Martiška

Today, we released Quarkus 3.33.4, our next maintenance release for the 3.33 LTS stream.

This release contains bugfixes, documentation updates, and security fixes.

It should be a safe upgrade for anyone already using 3.33.

Security fixes

This release fixes the following CVEs:

Quarkus and direct dependencies

  • CVE-2026-89407 - FasterXML jackson-core: Denial of Service via quadratic regex backtracking in number validation

  • CVE-2026-89425 - FasterXML jackson-core: Denial of Service via unbounded error-token accumulation in UTF8DataInputJsonParser

  • CVE-2026-91777 - FasterXML jackson-databind: Denial of Service via quadratic-time forward-reference resolution for @JsonIdentityInfo

  • CVE-2026-91776 - FasterXML jackson-databind: Denial of Service via unbounded deserializer cache growth for unrecognized polymorphic type IDs

  • CVE-2026-84939 - Apache FreeMarker: Path traversal via malformed locale identifier

  • CVE-2026-94449 - Quarkus SmallRye Fault Tolerance: Memory leak in @ApplyGuard leads to Denial of Service

  • CVE-2026-82617 - Apache OpenNLP: Denial of Service via super-linear regex backtracking in built-in name finders

  • CVE-2026-68497 - Jackson-databind: Denial of Service via unbounded number parsing for Duration/XMLGregorianCalendar

  • CVE-2026-89059 - RESTEasy: Denial of Service via unbounded memory allocation in IIOImageProvider

  • CVE-2026-93432 - Quarkus Qute: Cross-Site Scripting via missing content-type propagation in {#eval} sub-templates

  • CVE-2026-59949 - LZ4 Java: Denial of Service via native XXHash crash on invalid byte array ranges

  • CVE-2026-59296 - Micrometer: Metrics injection/spoofing via unsanitized newline characters in StatsD and logging registries

  • CVE-2026-59295 - Micrometer: Denial of Service via unbounded memory leak in HttpAsyncClient instrumentation

プラットフォームの更新

This release includes Quarkus CXF 3.33.12.

  • Release notes for Quarkus CXF 3.33.10

  • Release notes for Quarkus CXF 3.33.11 and 3.33.12 are not yet published at the time of publishing this announcement

Update

To update to Quarkus 3.33, we recommend updating to the latest version of the Quarkus CLI and run:

quarkus update --stream=3.33

Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.33.

完全な変更履歴

You can get the full changelog of 3.33.4 on GitHub.

参加のお誘い

私達は皆様からのフィードバックに重きを置いています。バグ報告、改善要望を是非お願いします。一緒に素晴らしいものを作り上げていきましょう!

Quarkusユーザーの場合でも、単に興味を持っているだけの場合でも、恥ずかしがらずにコミュニティに参加して下さい!:

Quarkus is open. All dependencies of this project are available under the Apache Software License 2.0 or compatible license. CC by 3.0

This website was built with Roq on Quarkus, is hosted on GitHub Pages and is completely open source. If you want to make it better, fork the website and show us what you’ve got.

ナビゲーション
フォローする
ヘルプ
言語
Quarkusはコミュニティプロジェクトで構成されています
Copyright © Quarkus. All rights reserved. For details on our trademarks, please visit our Trademark Policy and Trademark List. Trademarks of third parties are owned by their respective holders and their mention here does not suggest any endorsement or association.