Quarkus calls it maintenance and fixes fifteen CVEs
Victoria Shinder1 min readQuarkus 3.39.5 is out on the 3.39 train, described by the project as bugfixes and documentation work and a safe upgrade for anyone already on 3.39. The security content is larger than that framing suggests: fifteen CVEs are fixed.
Four of them sit in the stack a Quarkus application touches directly. CVE-2026-77874 is SQL injection in Hibernate ORM through an unescaped JSON path segment, allowing data exfiltration and an authorization bypass. CVE-2026-87743 is an authorization bypass in Quarkus HTTP security caused by a path-normalization discrepancy. CVE-2026-81829 is an unauthenticated same-origin SSRF in SmallRye JWT via an unsanitised kid header in AwsAlbKeyResolver. CVE-2026-87742 is an out-of-memory denial of service in Quarkus WebSockets Next through unbounded message buffering.
Nine more are in zstd-jni: use-after-free issues, out-of-bounds reads in the dictionary constructors and in Zstd.trainFromBufferDirect, a negative length parameter, and a remote use-after-free in dictionary sharing. The list closes with CVE-2026-19611, a password keyspace reduction in WildFly Elytron via NFKC fullwidth folding, and CVE-2026-84939, path traversal in Apache FreeMarker through a malformed locale identifier.
What it means
Read the release note and you get "maintenance"; read the CVE list and you get a security release for most of the runtime's surface. Both descriptions are accurate, which is the problem: the word in the title is what decides whether an upgrade is scheduled this week or next quarter.
The path-normalization bypass deserves separate attention. An authorization check that disagrees with the router about what a path means is a class that keeps returning, because the two components are usually written by different people against different assumptions about encoding. If you have custom rules layered on Quarkus HTTP security, this is the one to verify by request rather than by reading the changelog.