Quarkus
- Products in analyzed data
- 1
- Catalog vulnerabilities
- 50
Severity across 1 analyzed records
Verify to analyze this security profile
A short verification protects source data and prevents automated AI requests.
en
Severity across 1 analyzed records
A short verification protects source data and prevents automated AI requests.
As of 09/11/2026, Quarkus recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, quarkus-qute had the most security vulnerabilities in the Quarkus ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-12894Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine | Exploitation statusNot known exploited | FixYes | Affected productquarkus-qute | Published08/31/2026 | SeverityHigh |
CVE-2026-50559Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities | Exploitation statusPublic exploit | FixNot confirmed | Affected productquarkus | Published06/19/2026 | SeverityHigh |
CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistency | Exploitation statusNot known exploited | FixYes | Affected productquarkus | Published05/05/2026 | SeverityHigh |
CVE-2025-66560Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write | Exploitation statusNot known exploited | FixYes | Affected productquarkus | Published01/07/2026 | SeverityMedium |
CVE-2024-12225Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass | Exploitation statusNot known exploited | FixYes | Affected productquarkus | Published05/06/2025 | SeverityCritical |
CVE-2023-6267Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations. | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat build of Quarkus 2.13.9.Final | Published01/25/2024 | SeverityHigh |
CVE-2023-6394Quarkus: graphql operations over websockets bypass | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat build of Quarkus 2.13.9.Final | Published12/09/2023 | SeverityHigh |
CVE-2023-5720Quarkus: build env information disclosure via gradle plugin | Exploitation statusNot confirmed | FixNot confirmed | Affected productgradle-plugin | Published11/15/2023 | SeverityHigh |
CVE-2023-1584Quarkus-oidc: id and access tokens leak via the authorization code flow | Exploitation statusNot confirmed | FixNot confirmed | Affected productRed Hat build of Quarkus 2.13.8.Final | Published10/04/2023 | SeverityHigh |
CVE-2023-4853Quarkus: http security policy bypass | Exploitation statusNot confirmed | FixNot confirmed | Affected productOpenshift Serverless 1 on RHEL 8 | Published09/20/2023 | SeverityHigh |
CVE-2023-0481CVE-2023-0481 | Exploitation statusNot known exploited | FixNot confirmed | Affected productquarkus | Published02/24/2023 | SeverityLow |
CVE-2023-0044CVE-2023-0044 | Exploitation statusNot known exploited | FixNot confirmed | Affected productquarkus-vertx-http | Published02/23/2023 | SeverityUnknown |
CVE-2022-4147CVE-2022-4147 | Exploitation statusNot known exploited | FixNot confirmed | Affected productquarkus-2 | Published12/06/2022 | SeverityHigh |
CVE-2022-4116CVE-2022-4116 | Exploitation statusNot known exploited | FixNot confirmed | Affected productquarkus | Published11/22/2022 | SeverityCritical |
CVE-2022-42003CVE-2022-42003 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2022-42004CVE-2022-42004 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2022 | SeverityUnknown |
CVE-2022-2466CVE-2022-2466 | Exploitation statusNot confirmed | FixNot confirmed | Affected productquarkus | Published08/31/2022 | SeverityUnknown |
CVE-2022-0981CVE-2022-0981 | Exploitation statusNot confirmed | FixNot confirmed | Affected productquarkus | Published03/23/2022 | SeverityUnknown |
CVE-2022-21724Unchecked Class Instantiation when providing Plugin Classes | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published02/02/2022 | SeverityHigh |
CVE-2022-21363CVE-2022-21363 | Exploitation statusNot known exploited | FixNot confirmed | Affected productMySQL Connectors | Published01/19/2022 | SeverityMedium |
CVE-2021-43797HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling | Exploitation statusNot confirmed | FixNot confirmed | Affected productnetty | Published12/09/2021 | SeverityMedium |
CVE-2021-2471CVE-2021-2471 | Exploitation statusNot known exploited | FixNot confirmed | Affected productMySQL Connectors | Published10/20/2021 | SeverityMedium |
CVE-2021-37137CVE-2021-37137 | Exploitation statusNot confirmed | FixYes | Affected productNetty | Published10/19/2021 | SeverityUnknown |
CVE-2021-37136CVE-2021-37136 | Exploitation statusNot confirmed | FixYes | Affected productNetty | Published10/19/2021 | SeverityUnknown |
CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and Clients | Exploitation statusNot confirmed | FixNot confirmed | Affected productApache Kafka | Published09/22/2021 | SeverityUnknown |
CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions | Exploitation statusNot confirmed | FixYes | Affected productjsoup | Published08/18/2021 | SeverityHigh |
CVE-2021-3642CVE-2021-3642 | Exploitation statusNot confirmed | FixNot confirmed | Affected productwildfly-elytron | Published08/05/2021 | SeverityUnknown |
CVE-2021-28170CVE-2021-28170 | Exploitation statusNot confirmed | FixNot confirmed | Affected productJakarta Expression Language Implementation | Published05/26/2021 | SeverityUnknown |
CVE-2020-25724CVE-2020-25724 | Exploitation statusNot confirmed | FixNot confirmed | Affected productresteasy | Published05/26/2021 | SeverityUnknown |
CVE-2021-26291block repositories using http by default | Exploitation statusNot confirmed | FixNot confirmed | Affected productApache Maven | Published04/23/2021 | SeverityUnknown |
CVE-2021-29427Repository content filters do not work in Settings pluginManagement | Exploitation statusNot confirmed | FixNot confirmed | Affected productgradle | Published04/13/2021 | SeverityHigh |
CVE-2021-29428Local privilege escalation through system temporary directory | Exploitation statusNot confirmed | FixNot confirmed | Affected productgradle | Published04/13/2021 | SeverityHigh |
CVE-2021-29429Information disclosure through temporary directory permissions | Exploitation statusNot confirmed | FixNot confirmed | Affected productgradle | Published04/12/2021 | SeverityMedium |
CVE-2021-21409Possible request smuggling in HTTP/2 due missing validation of content-length | Exploitation statusNot confirmed | FixNot confirmed | Affected productnetty | Published03/30/2021 | SeverityMedium |
CVE-2021-20289CVE-2021-20289 | Exploitation statusNot confirmed | FixNot confirmed | Affected productresteasy | Published03/26/2021 | SeverityUnknown |
CVE-2021-21295Possible request smuggling in HTTP/2 due missing validation | Exploitation statusNot confirmed | FixYes | Affected productio.netty:netty-codec-http2 | Published03/09/2021 | SeverityMedium |
CVE-2021-20328MongoDB Java driver client-side field level encryption not verifying KMS host name | Exploitation statusNot known exploited | FixYes | Affected productmongo-java-driver | Published02/25/2021 | SeverityMedium |
CVE-2020-28491Denial of Service (DoS) | Exploitation statusNot confirmed | FixYes | Affected productcom.fasterxml.jackson.dataformat:jackson-dataformat-cbor | Published02/18/2021 | SeverityHigh |
CVE-2021-21290Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files | Exploitation statusNot confirmed | FixYes | Affected productnetty | Published02/08/2021 | SeverityMedium |
CVE-2020-8908Temp directory permission issue in Guava | Exploitation statusNot confirmed | FixYes | Affected productGuava | Published12/10/2020 | SeverityLow |
CVE-2020-25649CVE-2020-25649 | Exploitation statusNot confirmed | FixNot confirmed | Affected productjackson-databind | Published12/03/2020 | SeverityUnknown |
CVE-2020-13956CVE-2020-13956 | Exploitation statusNot confirmed | FixNot confirmed | Affected productApache HttpClient | Published12/02/2020 | SeverityUnknown |
CVE-2020-25638CVE-2020-25638 | Exploitation statusNot known exploited | FixNot confirmed | Affected producthibernate-core | Published12/02/2020 | SeverityHigh |
CVE-2020-25633CVE-2020-25633 | Exploitation statusNot confirmed | FixNot confirmed | Affected productresteasy-client | Published09/18/2020 | SeverityMedium |
CVE-2019-14900CVE-2019-14900 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHibernate | Published07/06/2020 | SeverityUnknown |
CVE-2020-13692CVE-2020-13692 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/04/2020 | SeverityUnknown |
CVE-2020-1714CVE-2020-1714 | Exploitation statusNot confirmed | FixNot confirmed | Affected productkeycloak | Published05/13/2020 | SeverityHigh |
CVE-2020-10693CVE-2020-10693 | Exploitation statusNot confirmed | FixNot confirmed | Affected producthibernate-validator | Published05/06/2020 | SeverityMedium |
CVE-2020-1728CVE-2020-1728 | Exploitation statusNot confirmed | FixNot confirmed | Affected productkeycloak | Published04/06/2020 | SeverityMedium |
CVE-2017-18640CVE-2017-18640 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/12/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan