Red Hat Build Of Quarkus
Monthly
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.