RHSA-2026:95289: Important: Red Hat build of Quarkus 3.33.4.SP3 release and security update

This release of Red Hat build of Quarkus 3.33.4.SP3 includes the following CVE fixes: guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [quarkus-3.33] (CVE-2026-102554) lz4-java: lz4-java: Denial of Service via excessive memory allocation from crafted compressed streams [quarkus-3.33] (CVE-2026-106450) lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling [quarkus-3.33] (CVE-2026-106451) lz4-java: lz4-java: Denial of Service via excessive memory allocation [quarkus-3.33] (CVE-2026-106452) lz4-java: lz4-java: Denial of Service via untrusted decompressed length header [quarkus-3.33] (CVE-2026-106453) mysql-connector-j: MySQL Connectors: Information Disclosure via Network Access [quarkus-3.33] (CVE-2026-60586) mysql-connector-j: MySQL Connector/J: Data Compromise and Partial Service Interruption [quarkus-3.33] (CVE-2026-60623) mysql-connector-j: MySQL Connector/J: Denial of Service via unauthenticated network access with user interaction [quarkus-3.33] (CVE-2026-60624) mysql-connector-j: MySQL Connector/J: Information disclosure vulnerability [quarkus-3.33] (CVE-2026-61082) mysql-connector-j: Connector/J unspecified vulnerability (CPU Apr 2025) [quarkus-3.33] (CVE-2025-30706) snappy-java: snappy-java: Denial of Service via out-of-bounds write [quarkus-3.33] (CVE-2026-90559) snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress [quarkus-3.33] (CVE-2026-93452) snappy-java: snappy-java: Buffer overflow via malformed compressed input [quarkus-3.33] (CVE-2026-93451) snappy-java: snappy-java: Denial of Service via out-of-bounds memory access [quarkus-3.33] (CVE-2026-116590) quarkus-vertx-http: quarkus-vertx-http: Authorization bypass in management interface via path concatenation flaw [quarkus-3.33] (CVE-2026-107912) snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression [quarkus-3.33] (CVE-2026-108106) snappy-java: snappy-java: information disclosure via double release of pooled buffers [quarkus-3.33] (CVE-2026-108104) vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb [quarkus-3.33] (CVE-2026-102477) vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure [quarkus-3.33] (CVE-2026-102460) For more information, see the release notes page listed in the References section.

— Red Hat