[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5M5vh2QLuPQHVLrhYpVwUdF3-cwciYq1Clf96EX9RdY":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":37,"kevVulnerabilities":98,"topProductsByCves":99,"seoMetadata":105,"meta":114},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":36},26218,"quarkus",5,45,0,448,"2024-01-25","q",[16,19,24,28,32],{"id":17,"product_name":8,"version_count":18,"cve_count":10,"kev_count":11,"last_cve_update":13},135522,363,{"id":20,"product_name":21,"version_count":22,"cve_count":11,"kev_count":11,"last_cve_update":23},135521,"gizmo",22,null,{"id":25,"product_name":26,"version_count":27,"cve_count":11,"kev_count":11,"last_cve_update":23},135523,"quarkus-fs-util",9,{"id":29,"product_name":30,"version_count":31,"cve_count":11,"kev_count":11,"last_cve_update":23},135524,"quarkus-http",42,{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":11,"last_cve_update":23},135525,"quarkus-security",12,"Quarkus is a technology vendor with 5 tracked products and 45 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[38,47,54,61,66,72,78,83,88,93],{"cveId":39,"description":40,"publishedDate":41,"cvssScore":42,"cvssVersion":43,"severity":44,"isKev":45,"epssScore":46},"CVE-2022-4116","A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.","2022-11-22",9.8,"v3.1","Critical",false,0.32516,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":51,"cvssVersion":43,"severity":52,"isKev":45,"epssScore":53},"CVE-2017-18640","The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","2019-12-12",7.5,"High",0.26723,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":58,"cvssVersion":43,"severity":59,"isKev":45,"epssScore":60},"CVE-2021-21295","Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP\u002F2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP\u002F1.1. If the request comes in as an HTTP\u002F2 stream, gets converted into the HTTP\u002F1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP\u002F1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP\u002F1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP\u002F2 to HTTP\u002F1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP\u002F1.1 objects, and these HTTP\u002F1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.","2021-03-09",5.9,"Medium",0.18891,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":51,"cvssVersion":43,"severity":52,"isKev":45,"epssScore":65},"CVE-2020-25649","A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","2020-12-03",0.17714,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":43,"severity":59,"isKev":45,"epssScore":71},"CVE-2020-13956","Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.","2020-12-02",5.3,0.09032,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":43,"severity":44,"isKev":45,"epssScore":77},"CVE-2021-26291","Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https:\u002F\u002Fmaven.apache.org\u002Frepository-management.html","2021-04-23",9.1,0.08691,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":58,"cvssVersion":43,"severity":59,"isKev":45,"epssScore":82},"CVE-2021-2471","Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector\u002FJ). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H).","2021-10-20",0.07493,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":51,"cvssVersion":43,"severity":52,"isKev":45,"epssScore":87},"CVE-2021-37714","jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and\u002For implement thread watchdogs to cap and timeout parse runtimes.","2021-08-18",0.06689,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":51,"cvssVersion":43,"severity":52,"isKev":45,"epssScore":92},"CVE-2021-37137","The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.","2021-10-19",0.06565,{"cveId":94,"description":95,"publishedDate":96,"cvssScore":58,"cvssVersion":43,"severity":59,"isKev":45,"epssScore":97},"CVE-2021-38153","Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.","2021-09-22",0.06201,[],[100,101,102,103,104],{"id":17,"product_name":8,"version_count":18,"cve_count":10,"kev_count":11,"last_cve_update":13},{"id":20,"product_name":21,"version_count":22,"cve_count":11,"kev_count":11,"last_cve_update":23},{"id":25,"product_name":26,"version_count":27,"cve_count":11,"kev_count":11,"last_cve_update":23},{"id":29,"product_name":30,"version_count":31,"cve_count":11,"kev_count":11,"last_cve_update":23},{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":11,"last_cve_update":23},{"title":106,"metaDescription":107,"keywords":108,"structuredData":109},"Quarkus - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Quarkus covering 5 products with 45 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Quarkus vulnerabilities, Quarkus security, Quarkus CVE, Quarkus threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":110,"@type":111,"name":112,"description":107,"url":113},"https:\u002F\u002Fschema.org","Organization","Quarkus","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fquarkus",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":115,"apiVersion":116},"2026-10-17T13:25:22.704Z","3.0"]