GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:7109

Vulnerability from csaf_redhat - Published: 2026-04-14 17:18 - Updated: 2026-09-15 20:14
Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.20.6 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.20.6 includes the following CVE fixes: * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [quarkus-3.20] (CVE-2026-33870) * netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [quarkus-3.20] (CVE-2026-33871) * plexus-utils: Plexus-utils: Directory Traversal in extractFile method [quarkus-3.20] (CVE-2025-67030) * avro: Apache Avro Java SDK: Code injection on Java generated code [quarkus-3.20] (CVE-2025-33042) * vertx-core: static handler component cache can be manipulated to deny the access to static files [quarkus-3.20] (CVE-2026-1002) For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-33042

A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas.

5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Product Identifier Version Remediation
Red Hat build of Quarkus 3.20.6
Red Hat / Red Hat build of Quarkus
 cpe:/a:redhat:quarkus:3.20::el8 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2025-67030

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.

8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2025-33042
Threats
Impact Important
CVE-2026-1002

A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2025-33042
Threats
Impact Moderate
CVE-2026-33870

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2025-33042
Threats
Impact Important
CVE-2026-33871

A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2025-33042
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:7109 self
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/products/quarkus/ external
https://access.redhat.com/jbossnetwork/restricted… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://issues.redhat.com/browse/QUARKUS-6878 external
https://issues.redhat.com/browse/QUARKUS-7203 external
https://issues.redhat.com/browse/QUARKUS-7204 external
https://issues.redhat.com/browse/QUARKUS-7206 external
https://issues.redhat.com/browse/QUARKUS-7207 external
https://issues.redhat.com/browse/QUARKUS-7322 external
https://issues.redhat.com/browse/QUARKUS-7323 external
https://issues.redhat.com/browse/QUARKUS-7324 external
https://issues.redhat.com/browse/QUARKUS-7325 external
https://issues.redhat.com/browse/QUARKUS-7326 external
https://issues.redhat.com/browse/QUARKUS-7327 external
https://issues.redhat.com/browse/QUARKUS-7328 external
https://issues.redhat.com/browse/QUARKUS-7329 external
https://issues.redhat.com/browse/QUARKUS-7330 external
https://issues.redhat.com/browse/QUARKUS-7331 external
https://issues.redhat.com/browse/QUARKUS-7347 external
https://issues.redhat.com/browse/QUARKUS-7379 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-33042 self
https://bugzilla.redhat.com/show_bug.cgi?id=2439675 external
https://www.cve.org/CVERecord?id=CVE-2025-33042 external
https://nvd.nist.gov/vuln/detail/CVE-2025-33042 external
https://github.com/apache/avro/commit/84bc7322ca1… external
https://issues.apache.org/jira/browse/AVRO-4053 external
https://lists.apache.org/thread/fy88wmgf1lj9479vr… external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2025-67030 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451409 external
https://www.cve.org/CVERecord?id=CVE-2025-67030 external
https://nvd.nist.gov/vuln/detail/CVE-2025-67030 external
https://gist.github.com/weaver4VD/3216dac645220f8… external
https://github.com/codehaus-plexus/plexus-utils/c… external
https://github.com/codehaus-plexus/plexus-utils/i… external
https://github.com/codehaus-plexus/plexus-utils/p… external
https://github.com/codehaus-plexus/plexus-utils/p… external
https://access.redhat.com/security/cve/CVE-2026-1002 self
https://bugzilla.redhat.com/show_bug.cgi?id=2430180 external
https://www.cve.org/CVERecord?id=CVE-2026-1002 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1002 external
https://github.com/eclipse-vertx/vert.x/pull/5895 external
https://access.redhat.com/security/cve/CVE-2026-33870 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452453 external
https://www.cve.org/CVERecord?id=CVE-2026-33870 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33870 external
https://github.com/netty/netty/security/advisorie… external
https://w4ke.info/2025/06/18/funky-chunks.html external
https://w4ke.info/2025/10/29/funky-chunks-2.html external
https://www.rfc-editor.org/rfc/rfc9110 external
https://access.redhat.com/security/cve/CVE-2026-33871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452456 external
https://www.cve.org/CVERecord?id=CVE-2026-33871 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33871 external
https://github.com/netty/netty/security/advisorie… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.20.6 includes the following CVE fixes:\n\n* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [quarkus-3.20] (CVE-2026-33870)\n\n* netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [quarkus-3.20] (CVE-2026-33871)\n\n* plexus-utils: Plexus-utils: Directory Traversal in extractFile method [quarkus-3.20] (CVE-2025-67030)\n\n* avro: Apache Avro Java SDK: Code injection on Java generated code [quarkus-3.20] (CVE-2025-33042)\n\n* vertx-core: static handler component cache can be manipulated to deny the access to static files [quarkus-3.20] (CVE-2026-1002)\n\nFor more information, see the release notes page listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7109",
        "url": "https://access.redhat.com/errata/RHSA-2026:7109"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.20.6",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.20.6"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.20",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.20"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6878",
        "url": "https://issues.redhat.com/browse/QUARKUS-6878"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7203",
        "url": "https://issues.redhat.com/browse/QUARKUS-7203"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7204",
        "url": "https://issues.redhat.com/browse/QUARKUS-7204"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7206",
        "url": "https://issues.redhat.com/browse/QUARKUS-7206"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7207",
        "url": "https://issues.redhat.com/browse/QUARKUS-7207"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7322",
        "url": "https://issues.redhat.com/browse/QUARKUS-7322"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7323",
        "url": "https://issues.redhat.com/browse/QUARKUS-7323"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7324",
        "url": "https://issues.redhat.com/browse/QUARKUS-7324"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7325",
        "url": "https://issues.redhat.com/browse/QUARKUS-7325"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7326",
        "url": "https://issues.redhat.com/browse/QUARKUS-7326"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7327",
        "url": "https://issues.redhat.com/browse/QUARKUS-7327"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7328",
        "url": "https://issues.redhat.com/browse/QUARKUS-7328"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7329",
        "url": "https://issues.redhat.com/browse/QUARKUS-7329"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7330",
        "url": "https://issues.redhat.com/browse/QUARKUS-7330"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7331",
        "url": "https://issues.redhat.com/browse/QUARKUS-7331"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7347",
        "url": "https://issues.redhat.com/browse/QUARKUS-7347"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7379",
        "url": "https://issues.redhat.com/browse/QUARKUS-7379"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7109.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.20.6 release and security update",
    "tracking": {
      "current_release_date": "2026-09-15T20:14:07+00:00",
      "generator": {
        "date": "2026-09-15T20:14:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:7109",
      "initial_release_date": "2026-04-14T17:18:52+00:00",
      "revision_history": [
        {
          "date": "2026-04-14T17:18:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-14T17:18:52+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-15T20:14:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.20.6",
                "product": {
                  "name": "Red Hat build of Quarkus 3.20.6",
                  "product_id": "Red Hat build of Quarkus 3.20.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.20::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-33042",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-02-13T12:00:45.349337+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2439675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.20.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-33042"
        },
        {
          "category": "external",
          "summary": "RHBZ#2439675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-33042",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-33042"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-33042",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33042"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4",
          "url": "https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/AVRO-4053",
          "url": "https://issues.apache.org/jira/browse/AVRO-4053"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1",
          "url": "https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/02/12/2",
          "url": "https://www.openwall.com/lists/oss-security/2026/02/12/2"
        }
      ],
      "release_date": "2026-02-13T11:47:03.783000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-14T17:18:52+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7109"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code"
    },
    {
      "cve": "CVE-2025-67030",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-03-25T18:02:00.463244+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451409"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.20.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-67030"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451409",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
          "url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
        },
        {
          "category": "external",
          "summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
          "url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
        },
        {
          "category": "external",
          "summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
          "url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
        },
        {
          "category": "external",
          "summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
          "url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
        },
        {
          "category": "external",
          "summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
          "url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
        }
      ],
      "release_date": "2026-03-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-14T17:18:52+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7109"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
    },
    {
      "cve": "CVE-2026-1002",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-01-15T21:03:20.088599+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430180"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability allows a remote attacker to block access to specific static files, such as images, CSS or HTML files. However, the underlying Vert.x server, the API endpoints and other non-cached resources are not affected. Due to this reason, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.20.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430180",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430180"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vert.x/pull/5895",
          "url": "https://github.com/eclipse-vertx/vert.x/pull/5895"
        }
      ],
      "release_date": "2026-01-15T20:50:25.642000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-14T17:18:52+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7109"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example:\n\n~~~\nStaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);\n~~~",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files"
    },
    {
      "cve": "CVE-2026-33870",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-27T21:01:59.865839+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.20.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
          "url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110",
          "url": "https://www.rfc-editor.org/rfc/rfc9110"
        }
      ],
      "release_date": "2026-03-27T19:54:15.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-14T17:18:52+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7109"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
    },
    {
      "cve": "CVE-2026-33871",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-27T21:02:13.396015+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.20.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
        }
      ],
      "release_date": "2026-03-27T19:55:23.135000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-14T17:18:52+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.20.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7109"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.20.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.