Quarkus 3.27.6 released - LTS maintenance release
Today, we released Quarkus 3.27.6, our next maintenance release for the 3.27 LTS stream.
This release contains bugfixes, documentation updates, and security fixes.
It should be a safe upgrade for anyone already using 3.27.
Please note that this is planned to be the last update to 3.27. Anybody still on 3.27 is advised to look into upgrading to 3.33 or 3.40 (the next LTS) soon.
Security fixes
This release fixes the following CVEs:
Quarkus and direct dependencies
-
CVE-2026-89407 - FasterXML jackson-core: Denial of Service via quadratic regex backtracking in number validation
-
CVE-2026-89425 - FasterXML jackson-core: Denial of Service via unbounded error-token accumulation in
UTF8DataInputJsonParser -
CVE-2026-91777 - FasterXML jackson-databind: Denial of Service via quadratic-time forward-reference resolution for
@JsonIdentityInfo -
CVE-2026-91776 - FasterXML jackson-databind: Denial of Service via unbounded deserializer cache growth for unrecognized polymorphic type IDs
-
CVE-2026-84939 - Apache FreeMarker: Path traversal via malformed locale identifier
-
CVE-2026-94449 - Quarkus SmallRye Fault Tolerance: Memory leak in
@ApplyGuardleads to Denial of Service -
CVE-2026-82617 - Apache OpenNLP: Denial of Service via super-linear regex backtracking in built-in name finders
-
CVE-2026-68497 - Jackson-databind: Denial of Service via unbounded number parsing for
Duration/XMLGregorianCalendar -
CVE-2026-89059 - RESTEasy: Denial of Service via unbounded memory allocation in
IIOImageProvider -
CVE-2026-93432 - Quarkus Qute: Cross-Site Scripting via missing content-type propagation in
{#eval}sub-templates -
CVE-2026-59949 - LZ4 Java: Denial of Service via native XXHash crash on invalid byte array ranges
-
CVE-2026-61700 - MariaDB Connector/J:
allowLocalInfile=falsebypass via server-initiated LOCAL INFILE request -
CVE-2026-55856 - MariaDB Connector/J: Cleartext password disclosure via MITM on the initial handshake
-
CVE-2026-55857 - MariaDB Connector/J: Cleartext transmission of credentials during PAM authentication
-
CVE-2026-55858 - MariaDB Connector/J: Data corruption via incorrect character set handling after a mid-session charset change
Platform updates
This release includes Quarkus CXF 3.27.2.
Actualización
To update to Quarkus 3.27, we recommend updating to the latest version of the Quarkus CLI and run:
quarkus update --stream=3.27Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.27.
Registro completo de cambios
You can get the full changelog of 3.27.6 on GitHub.
Únete a nosotros
Valoramos mucho tus comentarios, así que por favor reporta errores, solicita mejoras… ¡Construyamos algo grandioso juntos!
Si eres un usuario de Quarkus o simplemente tienes curiosidad, no seas tímido y únete a nuestra acogedora comunidad:
-
proporcionar retroalimentación en GitHub;
-
escribir algo de código y enviar push a PR;
-
comentar con nosotros en Zulip y en nuestra lista de correo;
-
hacer tus preguntas en Stack Overflow.
