--- title: Quarkus 3.27.5 released - LTS maintenance release description: Quarkus 3.27.5 has been released as a maintenance update for the 3.27 LTS stream. The release focuses heavily on security, patching 18 CVEs across Quarkus... canonical: https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Quarkus 3.27.5 released - LTS maintenance release | daily.dev og:description: Quarkus 3.27.5 has been released as a maintenance update for the 3.27 LTS stream. The release focuses heavily on security, patching 18 CVEs across Quarkus... og:url: https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh og:image: https://api.daily.dev/og/posts/Qn5AjMAeH.png og:image:alt: Quarkus 3.27.5 released - LTS maintenance release og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Quarkus 3.27.5 released - LTS maintenance release **[Quarkus](https://daily.dev/sources/quarkus)** · 2 min read · 1 upvotes · 0 comments ## Summary Quarkus 3.27.5 has been released as a maintenance update for the 3.27 LTS stream. The release focuses heavily on security, patching 18 CVEs across Quarkus direct dependencies and Netty (upgraded to 4.1.136.Final). Notable fixes include Eclipse Vert.x cross-origin header propagation and cross-domain cookie injection, Jackson-databind annotation bypass vulnerabilities, an authentication downgrade in OnGres SCRAM, a SQL injection in LangChain4j, and numerous Netty issues including zip bomb, CR/LF injection, memory exhaustion, and CORS access control flaws. The update is considered safe for existing 3.27 users and can be applied via the Quarkus CLI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security vulnerabilities does Quarkus 3.27.5 fix? Quarkus 3.27.5 patches several CVEs including Eclipse Vert.x cross-origin header propagation and cross-domain cookie injection issues, an OnGres SCRAM client authentication downgrade, Jackson-databind @JsonIgnore and @JsonView bypass bugs, a Jansi heap-based buffer overflow, and a LangChain4j SQL injection flaw in its embedding store metadata filter. It also upgrades Netty to 4.1.136.Final to resolve numerous additional vulnerabilities. _Track dependency CVEs like these on daily.dev before they hit a Quarkus production build._ ### What Netty version does Quarkus 3.27.5 use and what does it fix? Quarkus 3.27.5 upgrades to Netty 4.1.136.Final, which resolves numerous security issues including a zip bomb vulnerability in netty-codec-http, CR/LF neutralization bugs in netty-codec-http and netty-codec-haproxy, memory exhaustion and leak issues across several codecs, a protocol version confusion bug in websocket handling, and improper CORS access control in netty-codec-http. _Java developers pinning Netty versions can follow releases like this on daily.dev to stay ahead of patch cycles._ ### How do I update my application to Quarkus 3.27.5? Update to the latest Quarkus CLI and run quarkus update --stream=3.27, which upgrades any existing Quarkus application on the 3.27 LTS stream to 3.27.5. The quarkus update command can also migrate applications from any older Quarkus version, including 2.x, directly to the 3.27 LTS release. _daily.dev helps developers keep up with LTS maintenance releases before planning a Quarkus upgrade._ ## Similar posts on daily.dev - [Quarkus 3.27.5.3 released - LTS emergency release](https://daily.dev/posts/quarkus-3-27-5-3-released---lts-emergency-release-mfupitunp) · Quarkus · 0 upvotes · 0 comments - [Quarkus 3.39.2, 3.33.3.2 LTS, 3.27.5.2 LTS - Maintenance releases](https://daily.dev/posts/quarkus-3-39-2-3-33-3-2-lts-3-27-5-2-lts---maintenance-releases-dqwlc9fhu) · Quarkus · 3 upvotes · 0 comments - [Quarkus 3.39.5 - Maintenance release](https://daily.dev/posts/quarkus-3-39-5---maintenance-release-knufiofuj) · Quarkus · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#quarkus](https://daily.dev/tags/quarkus) [View this post on daily.dev](https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Quarkus 3.27.5 released - LTS maintenance release","url":"https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh"},"datePublished":"2026-07-29T10:18:08.864Z","dateModified":"2026-09-14T07:04:13.046Z","description":"Quarkus 3.27.5 has been released as a maintenance update for the 3.27 LTS stream. The release focuses heavily on security, patching 18 CVEs across Quarkus...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Quarkus","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Quarkus","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8adf82d719bb4a9492f44a28a27fd396","url":"https://daily.dev/sources/quarkus"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,quarkus","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Quarkus","item":"https://daily.dev/sources/quarkus"},{"@type":"ListItem","position":3,"name":"Quarkus 3.27.5 released - LTS maintenance release"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/quarkus-3-27-5-released---lts-maintenance-release-qn5ajmaeh#faq","mainEntity":[{"@type":"Question","name":"What security vulnerabilities does Quarkus 3.27.5 fix?","acceptedAnswer":{"@type":"Answer","text":"Quarkus 3.27.5 patches several CVEs including Eclipse Vert.x cross-origin header propagation and cross-domain cookie injection issues, an OnGres SCRAM client authentication downgrade, Jackson-databind @JsonIgnore and @JsonView bypass bugs, a Jansi heap-based buffer overflow, and a LangChain4j SQL injection flaw in its embedding store metadata filter. It also upgrades Netty to 4.1.136.Final to resolve numerous additional vulnerabilities. Track dependency CVEs like these on daily.dev before they hit a Quarkus production build."}},{"@type":"Question","name":"What Netty version does Quarkus 3.27.5 use and what does it fix?","acceptedAnswer":{"@type":"Answer","text":"Quarkus 3.27.5 upgrades to Netty 4.1.136.Final, which resolves numerous security issues including a zip bomb vulnerability in netty-codec-http, CR/LF neutralization bugs in netty-codec-http and netty-codec-haproxy, memory exhaustion and leak issues across several codecs, a protocol version confusion bug in websocket handling, and improper CORS access control in netty-codec-http. Java developers pinning Netty versions can follow releases like this on daily.dev to stay ahead of patch cycles."}},{"@type":"Question","name":"How do I update my application to Quarkus 3.27.5?","acceptedAnswer":{"@type":"Answer","text":"Update to the latest Quarkus CLI and run quarkus update --stream=3.27, which upgrades any existing Quarkus application on the 3.27 LTS stream to 3.27.5. The quarkus update command can also migrate applications from any older Quarkus version, including 2.x, directly to the 3.27 LTS release. daily.dev helps developers keep up with LTS maintenance releases before planning a Quarkus upgrade."}}]} ```