The Red Hat build of Quarkus 3.20.5 release includes fixes for three vulnerabilities: CVE-2025-67735 addresses a request smuggling vulnerability via CRLF injection in netty-codec-http; CVE-2025-59432 mitigates a timing attack vulnerability in SCRAM authentication; and CVE-2025-66560 resolves a REST worker thread exhaustion vulnerability. These issues were rated as moderate in severity by Red Hat Product Security. The advisory does not provide CVSS scores but references detailed CVE information. The update is intended to be applied on systems running the affected Quarkus build after prior errata are installed.

The vulnerabilities fixed in this update could allow attackers to exploit request smuggling via CRLF injection, perform timing attacks on SCRAM authentication, or exhaust REST worker threads, potentially impacting application reliability and security. The overall security impact is rated moderate by Red Hat. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an official security update in Quarkus version 3.20.5 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's documentation. No additional mitigation steps are indicated by the vendor advisory.