The Red Hat build of Quarkus 3.27.3 release includes fixes for five distinct vulnerabilities: CVE-2026-33871 (Netty HTTP/2 denial of service via CONTINUATION frame flood), CVE-2026-33870 (Netty HTTP request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extensions), CVE-2025-67030 (directory traversal in Plexus-utils extractFile method), CVE-2025-33042 (code injection vulnerability in Apache Avro Java SDK generated Java code), and CVE-2026-1002 (manipulation of Vert.x static handler cache leading to denial of access to static files). These vulnerabilities affect the Red Hat build of Quarkus at version 3.27.3 and have been addressed in this release. No CVSS scores are provided in the advisory, but the update is rated as important by Red Hat.

Successful exploitation of these vulnerabilities could lead to denial of service conditions (CVE-2026-33871, CVE-2026-1002), unauthorized request smuggling attacks (CVE-2026-33870), directory traversal potentially exposing or overwriting files (CVE-2025-67030), and code injection via Apache Avro generated code (CVE-2025-33042). These impacts could compromise application availability, integrity, and security depending on the deployment context.

Red Hat has released version 3.27.3 of the Red Hat build of Quarkus which includes fixes for these vulnerabilities. Users should apply this update to remediate the issues. Before applying this update, ensure all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.