RHSA-2026:47189

Details:

This release of Red Hat build of Quarkus 3.27.4.SP3 includes the following CVE fixes:

• resteasy-reactive-client-processor: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service [quarkus-3.27] (CVE-2026-16308)

• vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [quarkus-3.27] (CVE-2026-15075)

• vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [quarkus-3.27] (CVE-2026-15076)

• netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [quarkus-3.27] (CVE-2026-55833)

• netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [quarkus-3.27] (CVE-2026-55831)

• netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [quarkus-3.27] (CVE-2026-55851)

• netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [quarkus-3.27] (CVE-2026-56745)

• netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [quarkus-3.27] (CVE-2026-56746)

• netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [quarkus-3.27] (CVE-2026-56819)

• netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [quarkus-3.27] (CVE-2026-59899)

• netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder [quarkus-3.27] (CVE-2026-59921)

• netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 [quarkus-3.27] (CVE-2026-59900)

• netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) [quarkus-3.27] (CVE-2026-59898)

For more information, see the release notes page listed in the References section.