RHSA-2025:1884: Important: Red Hat build of Quarkus 3.8.6.SP3 Security Update
This release of Red Hat build of Quarkus 3.8.6.SP3 contains security updates. For more information, see the release notespage listed in the References section.Security Fix(es): io.netty/netty-handler: SslHandler doesn't correctly validate packets, which can lead to a native crash when using native SSLEngine (CVE-2025-24970) io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247) io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2025:1884?
The severity of RHSA-2025:1884 is classified as important due to security vulnerabilities in the affected software.
How do I fix RHSA-2025:1884?
To fix RHSA-2025:1884, you should update your Red Hat Quarkus installation to the latest version provided in the advisory.
What vulnerabilities are addressed in RHSA-2025:1884?
RHSA-2025:1884 addresses a vulnerability in io.netty/netty-handler where SslHandler does not correctly validate packets.
Which versions of Red Hat Quarkus are affected by RHSA-2025:1884?
RHSA-2025:1884 affects all versions of Red Hat Quarkus that include the vulnerable io.netty/netty-handler package.
Is RHSA-2025:1884 part of a larger issue in Red Hat products?
RHSA-2025:1884 is part of ongoing security improvements and updates within Red Hat's ecosystem, specifically targeting vulnerabilities in Quarkus.