High [CVE-2026-84939] Path traversal via malformed locale identifier
This high-severity Red Hat Linux advisory covers CVE-2026-84939; related products: Red Hat build of Quarkus, Red Hat Single Sign-On 7.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Path traversal via malformed locale identifier. Red Hat rates this important (CVSS 7.5).
Weakness: CWE-22.
Affected products named by the advisory: Red Hat build of Quarkus; Red Hat Single Sign-On 7.
- 2.2.0
- 2.3.34
Official advisory · high-confidence parse· fetched 16 days ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, disable the localized lookup configuration setting within your Apache FreeMarker deployment. This setting is enabled by default and its deactivation prevents the processing of malformed locale identifiers that could lead to path traversal. Consult your application's documentation for specific instructions on how to configure FreeMarker to disable localized lookup. A restart of the affected application or service will be required for the changes to take effect. Disabling localized lookup may impact applications that rely on this feature for internationalization.
Official advisory · high-confidence parse· fetched 16 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.