CVE Tools
Track your stack

Red Hat Build of Quarkus

62 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Red Hat Build of Quarkus, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Build of Quarkus CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Build of Quarkus CVEs per month
MonthCVEs
2024-120
2025-010
2025-022
2025-031
2025-040
2025-051
2025-060
2025-070
2025-080
2025-091
2025-100
2025-110
2025-121
2026-011
2026-020
2026-030
2026-040
2026-050
2026-061
2026-070
2026-080
2026-093
2026-100
2026-113

Severity

How the 62 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical58%
  • High3048%
  • Medium2337%
  • Low46%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Build of Quarkus.

  1. CVE-2026-121837Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort4.3
  2. CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw7.7
  3. CVE-2026-120971Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses5.3
  4. CVE-2026-93432Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus6.1
  5. CVE-2026-10832Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload5.9
  6. CVE-2026-81829Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver5.3
  7. CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison8.1
  8. CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks7.5
  9. CVE-2024-3884Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded7.5
  10. CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack7.5
  11. CVE-2024-12225Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass9.1
  12. CVE-2025-2240Smallrye-fault-tolerance: smallrye fault tolerance7.5
  13. CVE-2025-1634Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout7.5
  14. CVE-2025-24970SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine7.5
  15. CVE-2023-4639Undertow: cookie smuggling/spoofing7.4

Product grouping is registry-driven, with AI assist and human review. How it works