Serguey Asael Shinder: Quarkus 3.39.5 closes four CVEs, and one of them is in Hibernate ORM
Quarkus 3.39.5 was released on 24 September as a maintenance release for the 3.39 train - bugfixes and documentation, described by Guillaume Smet as a safe upgrade for anyone already on 3.39. The reason to read the announcement rather than just bump the version is the CVE list, because three of the four are in components that are used well outside Quarkus.
- CVE-2026-77874 — Hibernate ORM. SQL injection via an unescaped JSON path segment, allowing data exfiltration and authorization bypass.
- CVE-2026-19611 — WildFly Elytron. Password keyspace reduction via NFKC fullwidth folding.
- CVE-2026-81829 — SmallRye JWT. Unauthenticated same-origin SSRF through an unsanitised JWT
kidheader inAwsAlbKeyResolver. - CVE-2026-87742 — Quarkus WebSockets Next. Denial of service by memory exhaustion through unbounded message buffering.
Announcement: https://quarkus.io/blog/quarkus-3-39-5-released/
Why this list is worth more than the version number
The Hibernate ORM entry is the one to act on first, and not only if you run Quarkus. JSON path expressions are the newest part of the ORM's query surface, they take a string, and a string that reaches SQL unescaped is the oldest vulnerability in the profession wearing a new container. If your code builds a JSON path fragment from anything a user influenced - a field name, a filter key, a sort parameter arriving as $.items[*].<name> - that is the call to audit, and the audit does not depend on which framework hosts the ORM.
The kid header case is worth a moment for the same reason. kid is a hint about which key to use, supplied by the party presenting the token, and a resolver that turns that hint into a fetch has built an unauthenticated request generator for anyone who can reach the endpoint. Anything that resolves a key by following data from an unverified token needs an allow-list of destinations rather than sanitisation of the input, because sanitising a URL correctly is harder than enumerating the three places your keys actually live.
And the WebSockets entry is the standard shape of a Java DoS: buffering without a bound. A message assembler that accumulates frames until the message is complete is correct until somebody never completes one.
Practical reading of a maintenance release: the version bump is the easy half. The CVE list tells you which of your own code paths to go and look at, and in this release three of the four point at code that is not Quarkus-specific at all.