Security feed

25 October 2026

advisoryOfficial CVE List25 Oct 2026

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-81829

Red Hat build of Quarkus 3.27.5.SP2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.3.SP2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Exploit Intelligence

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 3

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 3

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 8

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-81829
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #16352 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:15:30 GMT
Publisher date: Thu, 17 Sep 2026 14:01:30 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87743

Red Hat build of Quarkus 3.27.5.SP2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.3.SP2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Exploit Intelligence

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 3

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Debezium 3

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Fuse 7

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift AI (RHOAI)

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Dev Spaces

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-87743
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #16334 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:14:07 GMT
Publisher date: Fri, 18 Sep 2026 09:38:27 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Red Hat build of Quarkus 3.27.5.SP2 Red Hat build of Quarkus 3.33.3.SP2 Exploit Intelligence Red Hat Enterprise Linux AI (RHEL AI) 3 Red Hat Enterprise Linux AI (RHEL AI) 3 Red Hat Enterprise Linux AI (RHEL AI) 3 Red Hat Enterprise Linux AI (RHEL AI) 3 CVE-2026-87742

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87742

Red Hat build of Quarkus 3.27.5.SP2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.3.SP2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Exploit Intelligence

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux AI (RHEL AI) 3

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux AI (RHEL AI) 3

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux AI (RHEL AI) 3

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux AI (RHEL AI) 3

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-87742
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #16333 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:14:07 GMT
Publisher date: Thu, 17 Sep 2026 14:57:44 GMT

Read the original announcement