SB2026083155 - Multiple vulnerabilities in Red Hat build of Quarkus 3.27.4
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-40984)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in HTTP server instrumentations when handling specially crafted HTTP requests. A remote attacker can send a specially crafted HTTP request to cause a denial of service.
The issue affects applications only when one or more HTTP server instrumentations are configured and metrics are recorded through the instrumentation.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate arbitrary classes.
The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.
Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.
3) Incorrect authorization (CVE-ID: CVE-2026-54517)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access controls and modify view-restricted properties.
The vulnerability exists due to incorrect authorization in BeanDeserializer._deserializeUsingPropertyBased when deserializing property-based input with setterless collection or map creator properties. A remote attacker can send specially crafted JSON input to bypass access controls and modify view-restricted properties.
Only setterless collection or map properties annotated with a restricted @JsonView and processed under an active view are affected.
4) Incorrect authorization (CVE-ID: CVE-2026-54518)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass write-side authorization restrictions and modify view-restricted creator parameters.
The vulnerability exists due to improper authorization in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() when processing untrusted JSON input for unwrapped creator parameters. A remote attacker can supply crafted JSON data to bypass write-side authorization restrictions and modify view-restricted creator parameters.
This issue occurs when applications use @JsonView as a write-side authorization boundary together with constructor parameters annotated with both @JsonView and @JsonUnwrapped.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-54514)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause outbound DNS requests and disclose limited network information.
The vulnerability exists due to server-side request forgery in JDKFromStringDeserializer when deserializing untrusted JSON into a type containing an InetSocketAddress field. A remote attacker can supply a crafted hostname value to cause outbound DNS requests and disclose limited network information.
The DNS lookup occurs during readValue before application-level validation or explicit connection logic.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify otherwise ignored object attributes.
The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.
Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify object attributes during deserialization.
The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in POJO deserialization handling when processing crafted JSON input for properties with a renamed getter and an ignored setter. A remote attacker can supply a renamed JSON key to modify object attributes during deserialization.
This issue occurs with private backing fields retained through property inference, allowing the setter's ignore annotation to be bypassed.
8) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate non-allowlisted types.
The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.
The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.
9) Comparison using wrong factors (CVE-ID: CVE-2026-9800)
CWE-ID: CWE-1025 - Comparison using wrong factors
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authorization policies and gain unauthorized access to protected resources.
The vulnerability exists due to comparison using wrong factors in the Keycloak Policy Enforcer when handling request URLs containing the configured access-denied page path. A remote user can include the configured access-denied page path in a request URL as a path segment or query parameter to bypass authorization policies and gain unauthorized access to protected resources.
This can bypass role, scope, and User-Managed Access (UMA) permission checks.
Remediation
Install update from vendor's website.