Veille CVE

Septembre 2026

4 CVE

Critique 0 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat build of Quarkus 3.27.6.redhat » ✕
  1. CVE-2026-94449 7.5 Élevée

    Red Hat build of Quarkus 3.27.6.redhat · Red Hat build of Quarkus 3.33.4.redhat · Red Hat Exploit Intelligence · Red Hat build of Apache Camel 4 for Quarkus 3

    A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

  2. CVE-2026-93432 6.1 Moyenne

    Red Hat build of Quarkus 3.27.6.redhat · Red Hat build of Quarkus 3.33.4.redhat · Red Hat Exploit Intelligence · Red Hat build of Apache Camel 4 for Quarkus 3

    A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

  3. CVE-2026-89059 7.5 Élevée

    Red Hat build of Quarkus 3.27.6.redhat · Red Hat build of Quarkus 3.33.4.redhat · Red Hat Enterprise Linux 9 · Red Hat build of Apache Camel 4 for Quarkus 3

    A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

  4. CVE-2026-89058 7.4 Élevée

    Red Hat build of Quarkus 3.27.6.redhat · Red Hat build of Quarkus 3.33.4.redhat · Red Hat Enterprise Linux 9 · Red Hat build of Apache Camel 4 for Quarkus 3

    A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.