Red Hat Product Errata RHSA-2026:24502 - Security Advisory Issued: 2026-06-10 Updated: 2026-06-10 RHSA-2026:24502 - Security Advisory Overview Synopsis Important: Red Hat build of Quarkus 3.33.2 release and security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. Description This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes: netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578) netty-codec- http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581) netty-codec- http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584) netty-codec- http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587) netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579) For more information, see the release notes page listed in the References section. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat build of Quarkus Text-Only Advisories x86_64 Fixes QUARKUS-7634 - Enforce plexus-utils 3.6.1 to fix CVE-2025-67030 QUARKUS-7635 - Remove duplicated `plexus-utils` from bootstrap BOM QUARKUS-7636 - [3.33] Upgrade to Vert.x 4.5.26 and Netty 4.1.132.Final QUARKUS-7637 - [3.33] Bump Hibernate ORM to 7.2.9.Final, Reactive to 3.2.9.Final QUARKUS-7638 - Style and grammar review for the OpenID Connect authorization code flow QUARKUS-7639 - Style and grammar review for the "OpenID Connect (OIDC) and OAuth2 client and filters" guide QUARKUS-7640 - Updates to Infinispan 16.0.9 QUARKUS-7641 - Webauthn IT: move test-webauthn to the test scope QUARKUS-7642 - Also populate cache on GitHub Actions for main repo QUARKUS-7643 - Set up CodeQL security analysis for pull requests QUARKUS-7644 - Fix Oracle connection rollback interceptor QUARKUS-7645 - Fix xref link text in security-authentication-mechanisms.adoc QUARKUS-7646 - Docs: Add caution note to Using RestResponse section in rest-client.adoc QUARKUS-7647 - [3.33] Update to plexus-utils 3.6.1 QUARKUS-7648 - [3.34] Update SmallRye Fault Tolerance to 6.10.1 QUARKUS-7649 - Update Gradle template to select `quarkus-junit` or `quarkus-junit5` based on Quarkus platform version QUARKUS-7650 - Some minor uberjar improvements and a test for service concatenation QUARKUS-7651 - Prevent warning about Gauge having already been registered QUARKUS-7652 - OpenAPI: Detect repeated @PermissionsAllowed annotations in Swagger UI QUARKUS-7653 - JFR extension event fix QUARKUS-7654 - Honour the legacy resolver settings in go-offline goals QUARKUS-7655 - Refactor jar building to a first-write-wins approach QUARKUS-7656 - OpenShift Internal Registry Container Image Name QUARKUS-7657 - [3.33] documentation backports QUARKUS-7658 - Little asciidoc markup fix for the OIDC authentication guide QUARKUS-7659 - Use getRecommended() when displaying platforms to be imported in quarkus info command QUARKUS-7660 - Register `oracle.jdbc.OracleDriver` for reflection QUARKUS-7661 - Tightening workflow permissions QUARKUS-7666 - Elicitation and sampling fail in native mode QUARKUS-7686 - In 3.33 the kafka-streams-test-utils is unaligned with productized kafka-streams QUARKUS-7727 - Properly set path property for `quarkus-artifact.properties` QUARKUS-7728 - Fix `@ServerExceptionMapper` handling for generic types QUARKUS-7729 - Avoid skipping config tracking when the Quarkus build is skipped QUARKUS-7730 - Do not preinit UUID infrastructure for Vert.x anymore QUARKUS-7731 - Ensure that shared Config build time runtime fixed uses the expected profile when set from @TestProfile QUARKUS-7732 - Avoid trying to parse null URI QUARKUS-7733 - Fix typo in unused gRPC interceptor warnings QUARKUS-7734 - Move `OracleDatabaseTypeSubstitution` to `flyway-oracle` QUARKUS-7735 - List commands when you run `just` QUARKUS-7736 - Fix spelling error in Dev UI Docs screenshot QUARKUS-7737 - Use `<annotationProcessorPathsUseDepMgmt>` in new extension projects QUARKUS-7738 - Bump wildfly-elytron.version from 2.8.3.Final to 2.8.4.Final QUARKUS-7739 - Bump Keycloak version to 25.6.7 QUARKUS-7740 - build(deps): bump testcontainers.version from 2.0.3 to 2.0.4 QUARKUS-7741 - Review for the OpenID Connect client and token propagation quickstart QUARKUS-7742 - Bump bouncycastle to 1.84 QUARKUS-7743 - Bump SmallRye Certificate Generator to 0.9.2 QUARKUS-7744 - Bump webauthn4j.version from 0.28.0.RELEASE to 0.30.3.RELEASE QUARKUS-7745 - Fix JvmOption JSON serialization QUARKUS-7746 - OIDC code flow docs: fix incorrectly named PKCE state secret property QUARKUS-7747 - Avoid adding duplicate META-INF/ directories QUARKUS-7748 - Review for the "Deploying Quarkus applications to OpenShift" guide QUARKUS-7749 - Make some OIDC authentication failure messages more verbose QUARKUS-7750 - Remove the tech preview note from reactive-sql-clients.adoc QUARKUS-7751 - Fix infinite loop in `AeshConsole.deadlockSafeWrite()` during dev mode shutdown QUARKUS-7752 - Fix typo in Grafana dashboard title QUARKUS-7753 - Remove the org.lz4 exclusion, it's no longer necessary QUARKUS-7754 - Fixing two numbered procedures and their includes in OpenID Connect client and token propagation quickstart QUARKUS-7783 - [3.33] Move Kafka to 4.1.2 QUARKUS-7784 - [3.33] Strip matrix parameters from request paths during HTTP security policy matching QUARKUS-7785 - [3.33] Quarkus REST: fix `@Context` injection for records QUARKUS-7786 - Fix Jakarta Transaction link on transaction.adoc documentation QUARKUS-7787 - Undeprecate REST Client connect timeout config QUARKUS-7788 - Bump to quarkus-http 5.5.0 QUARKUS-7789 - Clarify X provider callback URI registration without Renarde-specific paths in the OIDC providers guide QUARKUS-7790 - Bump to Vert.x 4.5.27 and Netty 4.1.133.Final QUARKUS-7791 - Bump postgresql-jdbc.version to 42.7.11 QUARKUS-7795 - Prevent server's OpenTelemetry Context getting lost on client read timeout QUARKUS-7796 - VertxHttpHotReplacementSetup: move the httpInitiatedReload flag check QUARKUS-7797 - [3.34] Quarkus REST: fix @Context injection for records QUARKUS-7798 - Avoid CCE when reloading Vert.x trust store QUARKUS-7799 - Update RESTEasy Classic to 6.2.16.Final QUARKUS-7810 - Bump the hibernate group across 1 directory with 9 updates QUARKUS-7811 - [3.33] Pin actions to specific shas, and avoid using external actions when we can QUARKUS-7843 - Upgrade Infinispan to 16.0.12 and Protostream to 6.0.7 for RHBQ 3.33.2 QUARKUS-7863 - Bump postgresql-jdbc.version to 42.7.11 CVEs CVE-2026-42578 CVE-2026-42579 CVE-2026-42581 CVE-2026-42584 CVE-2026-42587 References https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/products/quarkus/ https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.33.2 https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .