8.6
High
CVE-2026-77874 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection
Description
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enterprise Build of Quarkus 3.33 | 3.33.1 → 3.33.3.SP1 | No fix stated |
| Enterprise Build of Quarkus 3.27 | 3.27.1 → 3.27.5.SP1 | No fix stated |
Other CVEs of Enterprise Build of Quarkus
The 4 CVEs of Enterprise Build of Quarkus →
CVE-2026-19625
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1"…
5.3
Medium
CVE-2026-19651
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass…
7.4
High
CVE-2026-16308
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a…
7.5
High