<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf" -->

---
title: Quarkus 3.33.3 released - LTS maintenance release
description: Quarkus 3.33.3 has been released as a maintenance update for the 3.33 LTS stream. The release focuses heavily on security, patching 19 CVEs across Quarkus...
canonical: https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Quarkus 3.33.3 released - LTS maintenance release | daily.dev
og:description: Quarkus 3.33.3 has been released as a maintenance update for the 3.33 LTS stream. The release focuses heavily on security, patching 19 CVEs across Quarkus...
og:url: https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf
og:image: https://api.daily.dev/og/posts/SgCOoVuqf.png
og:image:alt: Quarkus 3.33.3 released - LTS maintenance release
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quarkus 3.33.3 released - LTS maintenance release

**[Quarkus](https://daily.dev/sources/quarkus)** · 2 min read · 2 upvotes · 0 comments

## Summary

Quarkus 3.33.3 has been released as a maintenance update for the 3.33 LTS stream. The release focuses heavily on security, patching 19 CVEs across Quarkus direct dependencies and Netty (upgraded to 4.1.136.Final). Notable fixes include Eclipse Vert.x cross-origin header propagation and cross-domain cookie injection, pgjdbc channel binding downgrade, Jackson-databind @JsonIgnore and @JsonView bypasses, a Jansi heap buffer overflow, a LangChain4j SQL injection, and numerous Netty vulnerabilities covering zip bombs, CR/LF injection, memory exhaustion, and improper access control. Upgrading via the Quarkus CLI with the 3.33 stream flag is recommended.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://quarkus.io/blog/quarkus-3-33-3-released>

## Questions this post answers

### What CVEs does Quarkus 3.33.3 fix?

Quarkus 3.33.3 fixes CVEs in Eclipse Vert.x (cross-origin header propagation, cross-domain cookie injection), pgjdbc (channel binding downgrade), OnGres SCRAM client (authentication downgrade), Jackson-databind (@JsonIgnore and @JsonView bypasses), Jansi (heap buffer overflow), and LangChain4j (SQL injection in embedding store metadata filter). It also upgrades Netty to 4.1.136.Final for numerous additional CVEs.

_Teams patching Java services against known CVEs can track fixes like these through daily.dev._

### What does upgrading Netty to 4.1.136.Final fix in Quarkus 3.33.3?

The Netty 4.1.136.Final upgrade in Quarkus 3.33.3 addresses eleven CVEs, including a zip bomb vulnerability in netty-codec-http, CR/LF neutralization issues in netty-codec-http and netty-codec-haproxy, memory exhaustion and memory leak bugs across http, http2, and haproxy codecs, a websocket protocol version confusion issue, and improper CORS access control in netty-codec-http.

_Developers tracking Netty security patches can follow dependency updates like this on daily.dev._

### How do I update my application to Quarkus 3.33.3?

Update to the latest Quarkus CLI, then run 'quarkus update --stream=3.33' in your project. This command can update applications from any prior Quarkus version, including 2.x, up to the 3.33 LTS stream, making 3.33.3 a safe upgrade for anyone already on 3.33.

_daily.dev helps Java developers stay on top of LTS upgrade steps like this Quarkus update command._

## Similar posts on daily.dev

- [Quarkus 3.33.3.3 released - LTS emergency release](https://daily.dev/posts/quarkus-3-33-3-3-released---lts-emergency-release-0qtthw4xd) · Quarkus · 0 upvotes · 0 comments
- [Quarkus 3.32.3 - Maintenance release](https://daily.dev/posts/quarkus-3-32-3---maintenance-release-o8p7mmngc) · Quarkus · 0 upvotes · 0 comments
- [Quarkus 3.39.2, 3.33.3.2 LTS, 3.27.5.2 LTS - Maintenance releases](https://daily.dev/posts/quarkus-3-39-2-3-33-3-2-lts-3-27-5-2-lts---maintenance-releases-dqwlc9fhu) · Quarkus · 3 upvotes · 0 comments
- [Quarkus 3.33 LTS - new LTS version](https://daily.dev/posts/quarkus-3-33-lts---new-lts-version-gpeev6yg6) · Quarkus · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#quarkus](https://daily.dev/tags/quarkus)

[View this post on daily.dev](https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Quarkus 3.33.3 released - LTS maintenance release","url":"https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf"},"datePublished":"2026-07-29T10:18:08.900Z","dateModified":"2026-09-13T20:31:57.257Z","description":"Quarkus 3.33.3 has been released as a maintenance update for the 3.33 LTS stream. The release focuses heavily on security, patching 19 CVEs across Quarkus...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e7ab97eced21a845aaca4e155a5e5171?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Quarkus","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Quarkus","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8adf82d719bb4a9492f44a28a27fd396","url":"https://daily.dev/sources/quarkus"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,quarkus","timeRequired":"PT2M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Quarkus","item":"https://daily.dev/sources/quarkus"},{"@type":"ListItem","position":3,"name":"Quarkus 3.33.3 released - LTS maintenance release"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/quarkus-3-33-3-released---lts-maintenance-release-sgcoovuqf#faq","mainEntity":[{"@type":"Question","name":"What CVEs does Quarkus 3.33.3 fix?","acceptedAnswer":{"@type":"Answer","text":"Quarkus 3.33.3 fixes CVEs in Eclipse Vert.x (cross-origin header propagation, cross-domain cookie injection), pgjdbc (channel binding downgrade), OnGres SCRAM client (authentication downgrade), Jackson-databind (@JsonIgnore and @JsonView bypasses), Jansi (heap buffer overflow), and LangChain4j (SQL injection in embedding store metadata filter). It also upgrades Netty to 4.1.136.Final for numerous additional CVEs. Teams patching Java services against known CVEs can track fixes like these through daily.dev."}},{"@type":"Question","name":"What does upgrading Netty to 4.1.136.Final fix in Quarkus 3.33.3?","acceptedAnswer":{"@type":"Answer","text":"The Netty 4.1.136.Final upgrade in Quarkus 3.33.3 addresses eleven CVEs, including a zip bomb vulnerability in netty-codec-http, CR/LF neutralization issues in netty-codec-http and netty-codec-haproxy, memory exhaustion and memory leak bugs across http, http2, and haproxy codecs, a websocket protocol version confusion issue, and improper CORS access control in netty-codec-http. Developers tracking Netty security patches can follow dependency updates like this on daily.dev."}},{"@type":"Question","name":"How do I update my application to Quarkus 3.33.3?","acceptedAnswer":{"@type":"Answer","text":"Update to the latest Quarkus CLI, then run 'quarkus update --stream=3.33' in your project. This command can update applications from any prior Quarkus version, including 2.x, up to the 3.33 LTS stream, making 3.33.3 a safe upgrade for anyone already on 3.33. daily.dev helps Java developers stay on top of LTS upgrade steps like this Quarkus update command."}}]}
```