This Red Hat security advisory for Red Hat build of Quarkus 3.27.3 addresses five distinct vulnerabilities: CVE-2026-33871 (Netty HTTP/2 CONTINUATION frame flood causing denial of service), CVE-2026-33870 (Netty HTTP/1.1 request smuggling via incorrect chunked transfer encoding parsing), CVE-2025-67030 (Plexus-utils directory traversal in extractFile method), CVE-2025-33042 (Apache Avro Java SDK code injection in generated Java code), and CVE-2026-1002 (Vert.x core static handler cache manipulation leading to denial of access to static files). The advisory rates the update as important and provides a fixed release version 3.27.3 of Red Hat build of Quarkus. Users are advised to apply this update after ensuring all prior relevant errata are installed. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities fixed in this update could allow attackers to cause denial of service conditions, perform HTTP request smuggling, execute code injection via generated Java code, conduct directory traversal attacks, or manipulate cache to deny access to static files. These issues could impact the confidentiality, integrity, and availability of applications using affected components within Red Hat build of Quarkus. The severity is rated high by the source, reflecting significant potential impact if exploited.

A security update is available in Red Hat build of Quarkus version 3.27.3 that addresses these vulnerabilities. Users should apply this update promptly after confirming that all previously released relevant errata have been applied. Refer to the official Red Hat advisory RHSA-2026:7380 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance on applying the update. No additional mitigation steps are indicated beyond applying the official patch.