Quarkus 3.27

Apply the Java 21 baseline first. These rules cover Quarkus 3.27 LTS.

Runtime and platform scope

• Build against a single Quarkus 3.27 platform BOM and let it pin its extensions; a mixed extension set can miss backported fixes.
• Run JVM mode on JDK 21 when applying these rules and build native executables with GraalVM or Mandrel for JDK 21, which the 3.27 native guide requires.
• Quarkus ships 3.27 security backports as micro releases, some with a fourth version segment and an empty changelog, and an advisory's patched-version field can name a later release than the first one carrying the backport. Read the advisory and the release comparison before deciding whether a build is affected.
• Don't treat a Quarkus platform release as proof that its managed Netty is patched, because the BOM can trail Netty security releases: the 3.27.5.2 BOM manages a Netty 4.1 release inside the affected ranges of Netty's 2026 HTTP/1 request-smuggling, HTTP/2 header-value and HPACK, SNI, and HAProxy PROXY-protocol advisories. Check the resolved Netty modules against Netty's advisories or a scanner run of the resolved tree before exposing HTTP or TLS listeners, and take an aligned, compatibility-tested platform update or backport rather than a bare Netty override.
• Until a fixed Netty is in place, terminate untrusted HTTP at an ingress that enforces strict HTTP/1.1 framing and rejects CR, LF, and NUL in HTTP/2 header values before any translation to HTTP/1.1, and block direct backend access. Set quarkus.http.http2=false unless clients need HTTP/2, and leave quarkus.http.ssl.sni and