CVE-2026-8484 | org.fusesource.jansi:jansi:2.4.0

[jeejz]

https://cert.pl/en/posts/2026/06/CVE-2026-8484/

quarkus-bom → quarkus-core-deployment → org.aesh:readline:2.6 → org.fusesource.jansi:jansi:2.4.0

From the org.fusesource.jansi:jansi:2.4.0 GitHub repo, it is indicated that they have moved to org.jline:jansi. However, would like to hear whether this is addressed already or any work around available.

If there is nothing for now, when is the fix planned for 3.27.x series. (we are currently using 3.27.4.1)

[sberyozkin]

The team is exploring options right now for addressing it

[jeejz]

Is there any update on ETA

[jmartisk]

This will be fixed in 3.27.5. Target release date is next week.

[jmartisk]

(#55026 is the PR that resolves it)

[jeejz]

Thank you so much for the update, I have created one more discussion thread #55553 for couple more CVEs.