# Quarkus 3.27.5 released - LTS maintenance release

DevFeed: [Quarkus 3.27.5 released - LTS maintenance release](<https://devfeed.tech/articles/quarkus-3-27-5-released-lts-maintenance-release-43770.md>)

Original publisher: [Read original article](<https://quarkus.io/blog/quarkus-3-27-5-released/>)

Author: Jan Martiška (https://twitter.com/janmartiska)

Published: 2026-07-29T00:00:00Z

Content type: release

Language: en

Sources: [Quarkus - Supersonic Subatomic Java](<https://devfeed.tech/sources/quarkus-supersonic-subatomic-java.md>)

Topics: [Quarkus](<https://devfeed.tech/topics/quarkus.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Netty](<https://devfeed.tech/topics/netty.md>), [Security](<https://devfeed.tech/topics/security.md>), [bugfixes](<https://devfeed.tech/topics/bugfixes.md>)

Tags: [bugfixes](<https://devfeed.tech/tags/bugfixes.md>), [lts](<https://devfeed.tech/tags/lts.md>), [maintenance](<https://devfeed.tech/tags/maintenance.md>), [quarkus](<https://devfeed.tech/tags/quarkus.md>), [release](<https://devfeed.tech/tags/release.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [update](<https://devfeed.tech/tags/update.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Quarkus 3.27.5 is a maintenance release for the 3.27 LTS stream. It includes bug fixes, documentation updates, and security fixes across Quarkus and direct dependencies, including an upgrade to Netty 4.1.136.Final.

## Source excerpt

Today, we released Quarkus 3.27.5, our next maintenance release for the 3.27 LTS stream. This release contains bugfixes, documentation updates, and security fixes. It should be a safe upgrade for anyone already using 3.27. Security fixes This release fixes the following CVEs: Quarkus and direct dependencies CVE-2026-15075 - Eclipse Vert.x: DefaultRedirectHandler cross-origin header propagation CVE-2026-15076 - Eclipse Vert.x: WebClientSession cross-domain cookie injection CVE-2026-53712 - OnGres SCRAM client: Authentication downgrade CVE-2026-59888 - Jackson-databind: @JsonIgnore bypass with PropertyNamingStrategy on Java Records CVE-2026-59889 - Jackson-databind: @JsonView bypass for @JsonUnwrapped properties during deserialization CVE-2026-8484 - Jansi: Heap-based buffer overflow in JNI ioctl() wrapper CVE-2026-55405 - LangChain4j: SQL injection in embedding store metadata filter Netty This release upgrades Netty to 4.1.136.Final, which fixes numerous security vulnerabilities including: CVE-2026-55833 - Zip bomb vulnerability in netty-codec-http CVE-2026-59921 - Improper CR/LF neutralization in netty-codec-http (multipart) CVE-2026-59919 - Improper CR/LF neutralization in netty-codec-haproxy CVE-2026-55851 - Memory exhaustion in netty-codec-haproxy CVE-2026-56745 - Memory exhaustion in netty-codec-http CVE-2026-59899 - Memory exhaustion in netty-codec-http CVE-2026-55831 - Resource exhaustion/DoS in netty-codec-http CVE-2026-56819 - Memory leak in netty-codec-http2 CVE-2026-59900 - Improper header neutralization in netty-codec-http2 CVE-2026-59898 - Protocol version confusion in netty-codec-http (websocket) CVE-2026-56746 - Improper access control in netty-codec-http (CORS) For the full list, see the Netty 4.1.136.Final release announcement. Update To update to Quarkus 3.27, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update --stream=3.27 Note that quarkus update can update your applications from any version of Quarkus (includin