Quarkus
Quarkus: vulnerabilidades y CVE
Quarkus tiene 55 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE55
Últimos 12 meses6
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-94449 | Alta (7.5) | 0.49% | — | 21 sept 2026 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or… |
| CVE-2026-87743 | Alta (7.5) | 0.52% | — | 18 sept 2026 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a… |
| CVE-2026-19625 | Media (5.3) | 0.23% | — | 8 sept 2026 | When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider… |
| CVE-2026-50559 | Alta (7.5) | 0.67% | — | 19 jun 2026 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed… |
| CVE-2026-39852 | Alta (8.8) | 0.63% | — | 5 may 2026 | Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the… |
| CVE-2025-66560 | Alta (7.5) | 0.39% | — | 7 ene 2026 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response… |
| CVE-2025-49574 | Media (6.4) | 0.32% | — | 23 jun 2025 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus… |
| CVE-2024-12225 | Crítica (9.1) | 0.42% | — | 6 may 2025 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom… |
| CVE-2023-5675 | Media (6.5) | 0.46% | — | 25 abr 2024 | A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the… |
| CVE-2024-1979 | Baja (3.5) | 0.60% | — | 13 mar 2024 | A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk. |
| CVE-2023-6267 | Crítica (9.8) | 0.72% | — | 25 ene 2024 | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being… |
| CVE-2023-6394 | Crítica (9.1) | 0.81% | — | 9 dic 2023 | A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the… |
| CVE-2023-5720 | Alta (7.5) | 0.81% | — | 15 nov 2023 | A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially… |
| CVE-2023-1584 | Alta (7.5) | 0.96% | — | 4 oct 2023 | A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from… |
| CVE-2023-4853 | Alta (8.1) | 1.4% | — | 20 sept 2023 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an… |
| CVE-2023-0481 | Baja (3.3) | 0.21% | — | 24 feb 2023 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user. |
| CVE-2023-0044 | Media (6.1) | 0.55% | — | 23 feb 2023 | If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF… |
| CVE-2022-4147 | Alta (7.5) | 0.59% | — | 6 dic 2022 | Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned… |
| CVE-2022-4116 | Crítica (9.8) | 33% | — | 22 nov 2022 | A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution. |
| CVE-2022-42004 | Alta (7.5) | 3.4% | — | 2 oct 2022 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only… |
| CVE-2022-42003 | Alta (7.5) | 3.4% | — | 2 oct 2022 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the… |
| CVE-2022-2466 | Crítica (9.8) | 1.9% | — | 31 ago 2022 | It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. |
| CVE-2022-0981 | Alta (8.8) | 1.2% | — | 23 mar 2022 | A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database… |
| CVE-2022-21724 | Crítica (9.8) | 3.1% | — | 2 feb 2022 | pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker… |
| CVE-2022-21363 | Media (6.6) | 1.4% | — | 19 ene 2022 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with… |
| CVE-2021-43797 | Media (6.5) | 2.9% | — | 9 dic 2021 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they… |
| CVE-2021-2471 | Media (5.9) | 7.5% | — | 20 oct 2021 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with… |
| CVE-2021-37137 | Alta (7.5) | 6.6% | — | 19 oct 2021 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to… |
| CVE-2021-37136 | Alta (7.5) | 5.9% | — | 19 oct 2021 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The… |
| CVE-2021-38153 | Media (5.9) | 6.3% | — | 22 sept 2021 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.