This security advisory from Red Hat addresses two vulnerabilities in the Red Hat build of Quarkus 3.20.2. CVE-2025-49146 concerns insecure authentication in the PostgreSQL JDBC driver (pgjdbc) channel binding, categorized under CWE-287 (Improper Authentication). CVE-2025-49574 involves a potential data leak in Quarkus, related to CWE-668 (Exposure of Resource to Wrong Sphere). The update fixes these issues and includes multiple other enhancements and bug fixes. No CVSS scores are provided. The advisory recommends applying the 3.20.2 update after all prior errata are applied.

The vulnerabilities could allow improper authentication in database connections and potential data leakage within Quarkus applications, which may lead to unauthorized access or exposure of sensitive information. The severity is rated as high by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Red Hat has released version 3.20.2 of their build of Quarkus which includes fixes for these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated by the vendor advisory.