SB2024101594 - Multiple vulnerabilities in Red Hat build of Quarkus 3.2.12
Published: October 15, 2024 Updated: August 22, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: CVE-2024-7254)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields. A remote attacker can pass specially crafted input to the application to create unbounded recursions and perform a denial of service (DoS) attack.
2) Improper Certificate Validation (CVE-ID: CVE-2021-44549)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation when sending emails via SMTPS. A remote attacker can perform MitM attack.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2024-40094)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to GraphQL Java (aka graphql-java) does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Input validation error (CVE-ID: CVE-2024-47561)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when parsing schema in Java SDK. A remote attacker can pass specially crafted schema to the application and execute arbitrary code on the system.
Remediation
Install update from vendor's website.