Quarkus 2.16.x Release Notes

Notes

• This release originates from the open‑source Quarkus repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds, together with the backported security fixes listed below.

Bug Fixes

• Leak of local build-time configuration (environment variables and system properties) into recorded runtime defaults (CVE-2024-2700).
• Authentication bypass via the default WebAuthn callback endpoint being registered even for applications with custom endpoints (CVE-2024-12225).
• Denial of service from leaked response buffers in RESTEasy Classic when client connections end early (CVE-2025-1634).
• Denial of service from worker threads blocking indefinitely on a full write queue in RESTEasy Reactive (CVE-2025-66560).
• Authorization bypass via matrix parameters in HTTP path-based security policy matching (CVE-2026-39852).