The Red Hat build of Quarkus 3.27.3 release includes fixes for five security vulnerabilities: CVE-2026-33871 (Netty HTTP/2 CONTINUATION frame flood causing denial of service), CVE-2026-33870 (Netty HTTP/1.1 chunked transfer encoding extension parsing leading to request smuggling), CVE-2025-67030 (directory traversal in Plexus-utils extractFile method), CVE-2025-33042 (code injection vulnerability in Apache Avro Java SDK generated code), and CVE-2026-1002 (manipulation of Vert.x static handler component cache causing denial of access to static files). These vulnerabilities affect components bundled in the Red Hat build of Quarkus and are addressed in this release. The advisory rates the update as Important and recommends applying it after prior errata are installed.

The vulnerabilities fixed in this update could allow attackers to cause denial of service conditions, perform HTTP request smuggling, execute code injection via generated Java code, and exploit directory traversal flaws. These issues could impact the confidentiality, integrity, and availability of applications using the affected components within Red Hat build of Quarkus. However, no known exploits in the wild have been reported at this time.

Red Hat has provided an official security update in the form of Red Hat build of Quarkus 3.27.3 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been installed. Detailed instructions for applying the update are available in the Red Hat advisory. No additional mitigation actions are indicated by the vendor.