Security
The Quarkus team and community take all security bugs very seriously. You can find our guidelines here regarding our policy and security disclosure.
The Quarkus team and community take all security bugs very seriously. You can find our guidelines here regarding our policy and security disclosure.
|
Do NOT report security vulnerabilities in our public bug tracker. Follow the instructions given in this page. |
Reporting security issues
Please report any security issues you find in Quarkus to:
security at quarkus.ioAnyone can post to this list. The subscribers are only trusted individuals from the Quarkus community who will handle the resolution of any reported security issues in confidence. In your report, please note how you would like to be credited for discovering the issue and the details of any embargo you would like to impose. Currently the security response teams for the following distributions are subscribed to this list and will respond to your report:
Ecosystem
Quarkus is an ecosystem made from many extensions and many libraries (like Eclipse Vert.x, Hibernate, Apache Camel and more), most of them not under the direct responsibility of the Quarkus team. If you find a security bug possibly rooted in one of these libraries, you can either disclose to them directly or disclose them to the Quarkus team (following this process) and we will responsibly disclose the issue to the respective extension or library maintainer.
Supported Versions
The community will fix security bugs for the latest major.minor version published at https://quarkus.io/get-started/.
| Version | Supported |
|---|---|
Latest 3.x |
✅ |
3.15 LTS |
✅ |
3.8 LTS |
✅ |
Older 3.x |
❌ |
< 3.0 |
❌ |
We may fix the vulnerability to older versions depending on the severity of the issue and the age of the release, but we are only committing to the versions mentioned above as supported.
Handling security issues
If you represent a Quarkus extension or a Quarkus platform, you are welcome to subscribe to the security at quarkus.io mailing list. Your subscription will only be approved if you can demonstrate that you will handle issues in confidence and properly credit reporters for discovering issues (e.g. experience with embargo process).
