QU
Product
Quarkus
49
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 21Medium 19Low 2
Watch
Add Quarkus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-0981 | 8.8 | Mar 23 | A flaw was found in Quarkus Affected: before 2.7.1 |
| CVE-2020-1714 | 8.8 | May 13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks Affected: through 1.4.2 |
| CVE-2026-39852 | 8.2 | May 5 | Quarkus authorization bypass via semicolon path normalization inconsistency Affected: before 3.20.6.1; 3.21.0 before 3.27.3.1; 3.28.0 before 3.33.1.1; 3.34.0 before 3.34.7; 3.35.0 before 3.35.2 |
| CVE-2023-4853 | 8.1 | Sep 20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of… Affected: before 2.16.11; 3.2.0 before 3.2.6; 3.3.0 before 3.3.3 |
| CVE-2021-29428 | 7.8 | Apr 13 | Local privilege escalation through system temporary directory Affected: through 2.2.3 |
| CVE-2020-13692 | 7.7 | Jun 4 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE Affected: through 1.5.2 |
| CVE-2026-50559 | 7.5 | Jun 19 | Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities Affected: before 3.20.6.2; 3.21.0 before 3.27.4.1; 3.28.0 before 3.33.2.1; 3.34.0 before 3.36.3 |
| CVE-2025-66560 | 7.5 | Jan 7 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications Affected: before 3.20.5; 3.21.0 before 3.27.2; 3.30.0 before 3.31.0 |
| CVE-2023-5720 | 7.5 | Nov 15 | A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain Affected: 3.0.1 before 3.2.8; 3.0.0; 3.0.0 |
| CVE-2023-1584 | 7.5 | Oct 4 | A flaw was found in Quarkus Affected: before 2.13.8 |
| CVE-2022-4147 | 7.5 | Dec 6 | Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed Affected: 2.0 before 2.13.5; 2.14.0 before 2.14.2 |
| CVE-2022-42003 | 7.5 | Oct 2 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep… Affected: before 2.13.3 |
| CVE-2022-42004 | 7.5 | Oct 2 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested… Affected: before 2.13.0 |
| CVE-2021-37136 | 7.5 | Oct 19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) Affected: before 2.2.4 |
| CVE-2021-37137 | 7.5 | Oct 19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage Affected: before 2.2.4 |
| CVE-2021-37714 | 7.5 | Aug 18 | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions Affected: through 2.2.3 |
| CVE-2020-28491 | 7.5 | Feb 18 | This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1 Affected: before 2.0.2 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: through 1.6.1 |
| CVE-2017-18640 | 7.5 | Dec 12 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564 Affected: through 1.3.4 |
| CVE-2020-25638 | 7.4 | Dec 2 | A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final Affected: through 1.9.2 |
| CVE-2021-29427 | 7.2 | Apr 13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning Affected: through 2.2.3 |
Showing 21