live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releaseJAVA

Quarkus 3.33.3.SP1 closes authentication, template and transport flaws

The Important-rated service pack fixes 13 CVEs across common Quarkus extensions; teams should update the platform BOM and retest the features they actually ship.

Quarkus service pack fixes 13 CVEs across extensions.
AI-generated illustration
By The News Desk· Sep 3, 2026

Red Hat has issued an Important security update for the 3.33 long-term support stream of Red Hat build of Quarkus. RHSA-2026:62555, published September 3, moves the supported release to 3.33.3.SP1 and lists 13 CVEs.

This is not one defect repeated across packages. The advisory reaches several application-facing parts of a Quarkus stack, so the practical exposure depends on which extensions an application includes.

What the service pack fixes

The most direct application-security fixes are in Quarkus itself. Qute’s ReflectionValueResolver receives a fix for server-side template injection, the OIDC extension fixes a cross-tenant authentication bypass involving its shared token-introspection cache, and the Spring Web compatibility layer closes an authorization bypass using URL query-string manipulation. RESTEasy fixes an unauthenticated remote file-read issue in SourceProvider.

The dependency fixes broaden the review. Apache HttpComponents Client addresses both a connection-leak denial of service and improper TLS hostname verification that could permit server impersonation. Netty fixes a CORS Vary header disclosure issue and an OpenSSL client-path hostname-verification bypass. The MongoDB driver removes credential disclosure during client initialization.

Messaging and API stacks are also represented: SmallRye GraphQL fixes a denial of service using large-exponent floating-point literals, while Apache Qpid Proton-J fixes three separate denial-of-service paths involving nesting, allocation and symbol caching.

Who should prioritize the update

Teams should move fastest where applications use Qute with data that can influence template evaluation, multi-tenant OIDC, quarkus-spring-web, RESTEasy SourceProvider, outbound Apache HTTP clients, MongoDB, GraphQL or AMQP. Netty is foundational enough that teams should not assume they are unaffected merely because it is not declared directly in an application build.

Red Hat identifies the affected product as the Red Hat build of Quarkus 3.33 text-only advisory stream. The advisory does not publish a workaround; its solution is to apply the update after previously released relevant errata.

Upgrade and verification checklist

  1. Record the current Quarkus platform BOM and extension list before changing the build.
  2. Align the application to the Red Hat 3.33.3.SP1 platform artifacts rather than overriding individual transitive libraries. That avoids mixing tested and untested component versions.
  3. Rebuild from a clean dependency cache and inspect the resolved dependency tree for the affected HTTP client, Netty, MongoDB, SmallRye GraphQL and Proton-J components your application uses.
  4. Run focused regression tests for tenant isolation, route authorization, template rendering, file-producing REST endpoints, outbound TLS hostname verification and message parsing as applicable.
  5. Rebuild container images and generate a fresh software bill of materials; updating source metadata without replacing deployed artifacts does not remediate running workloads.
  6. Deploy through a staged environment, then verify the running image digest and application build metadata rather than relying only on a successful CI job.

The breadth of this service pack makes extension-aware testing more useful than a generic smoke test. The update target is one release, but the verification plan should follow the application’s actual dependency graph.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk