Quarkus 3.27.5 closes two authentication downgrade paths and an SSH certificate restriction bypass

Red Hat has rated its Quarkus 3.27.5 update Important, with fixes spanning database authentication, SSH certificate enforcement and a native-library denial-of-service path. The fixed product artifact is Red Hat build of Quarkus 3.27.5; RHSA-2026:53643 lists no separate patched stream or component-only package for operators to substitute.

What changed

Two of the four flaws weaken authentication protections around TLS. CVE-2026-53712 affects the SCRAM client and common libraries: an attacker positioned to intercept a TLS connection could silently move authentication from channel-bound SCRAM-SHA-256-PLUS to SCRAM-SHA-256 without channel binding. CVE-2026-54291 reaches a similar boundary through pgjdbc. Red Hat says the PostgreSQL JDBC driver failed to validate channel binding correctly for a specific certificate type, allowing an intercepted connection configured to require SCRAM-SHA-256-PLUS to fall back to plain SCRAM-SHA-256.

The most direct command-execution risk is CVE-2026-56624 in Apache MINA SSHD’s server-side OpenSSH certificate handling. During user authentication, the server did not properly enforce unsupported certificate options including force-command and verify-required. An authenticated user could therefore escape the command restrictions encoded in a certificate and run commands beyond those intended by the issuer. Red Hat scores that flaw 7.3, requiring network access, low privileges and user interaction.

The fourth fix, CVE-2026-8484, addresses a heap buffer overflow in Jansi’s JNI ioctl() wrapper. Red Hat describes this as a local, user-assisted denial-of-service path caused by missing argument-array size validation. Quarkus 3.27.5 also switches from the older org.fusesource.jansi artifact to org.jline:jansi as part of the update.

Who is affected

The advisory applies to applications built on the Red Hat build of Quarkus 3.27 stream that consume the affected SCRAM, pgjdbc, Apache MINA SSHD or Jansi paths. Exposure is not uniform: the two downgrade flaws require an attacker who can intercept TLS traffic; the SSHD flaw matters where an application accepts OpenSSH user certificates and relies on certificate options to constrain commands; the Jansi issue requires local access and user interaction.

That distinction should guide validation, but it should not be used to split the vendor update. Red Hat marks 3.27.5 as the fixed product across all four CVEs and says no mitigation meeting its deployment, applicability and stability criteria is available.

What operators should do

Inventory Red Hat Quarkus 3.27 applications, identify deployments using PostgreSQL SCRAM channel binding, embedded Apache MINA SSHD servers or Jansi, and prioritize externally reachable services. Apply previously released relevant errata, update the application’s Red Hat Quarkus platform and dependencies to 3.27.5, then rebuild and redeploy the application artifact through the normal tested delivery path.

After rollout, verify that PostgreSQL connections still negotiate the required channel-bound authentication and test SSH user certificates containing command restrictions. Those checks validate the two controls the update is meant to restore rather than treating a successful build as proof that the security boundary is working.