Quarkus ships an emergency LTS release carrying 29 CVEs
Serguey Asael Shinder2 min readQuarkus released 3.27.5.3 on 22 September 2026, described by the project as an emergency release for the 3.27 LTS stream. A matching emergency release went out for the 3.33 LTS stream.
The CVE list is the story. A few are in Quarkus itself:
- Quarkus Vert.x HTTP — authorization bypass through a path normalisation discrepancy in Quarkus HTTP security (CVE-2026-87743);
- Quarkus WebSockets Next — denial of service by out-of-memory through unbounded message buffering (CVE-2026-87742);
- Quarkus SmallRye Fault Tolerance — a memory leak in
@ApplyGuardleading to denial of service (CVE-2026-94449).
Most of the list is not Quarkus. Of the 29 entries, thirteen are Netty, and they cluster around HTTP protocol handling: request smuggling through incomplete validation of malformed Transfer-Encoding and through control characters in the chunk-size line; HTTP/1 authority-form CONNECT translated into a malformed HTTP/2 CONNECT with a Host-controlled :authority; HTTP/2 and HTTP/3 Extended CONNECT downgraded to regular CONNECT; unbounded queue growth in HttpServerCodec and in WebSocketServerExtensionHandler; an HpackEncoder denial of service on a large table size. Nine more are zstd-jni — use-after-free, out-of-bounds reads, a negative length parameter, a remote use-after-free in dictionary sharing.
The rest: Hibernate ORM SQL injection through an unescaped JSON path segment allowing data exfiltration and authorization bypass; Apache FreeMarker path traversal via a malformed locale identifier; WildFly Elytron password keyspace reduction through NFKC fullwidth folding; and SmallRye JWT unauthenticated same-origin SSRF through an unsanitised JWT kid header in AwsAlbKeyResolver.
What it means
Read the split before the total. Three of these are Quarkus bugs; the great majority arrived through the dependency tree, and no application team chose Netty or zstd-jni in the sense of evaluating them — they came with the framework.
That is exactly what an LTS stream is for, and it is also the argument for treating "emergency release" as a different class of event from a scheduled one. The HTTP smuggling cluster in particular is the kind that matters at a boundary: a proxy and an origin that disagree about where one request ends is a bypass of whatever sits between them, which is usually the authorization you trust.
The two Quarkus entries to read closely are the path-normalisation authorization bypass and the Fault Tolerance memory leak, because both are in code an application deliberately relies on for security and stability rather than in a transport it never thinks about.