The Red Hat build of Quarkus 3.20.4.SP1 security update addresses three vulnerabilities: CVE-2025-66566, an information disclosure issue due to insufficient output buffer clearing in lz4-java; CVE-2025-12183, an out-of-bounds memory operation in lz4-java leading to denial of service and information disclosure; and CVE-2025-11966, a cross-site scripting (CWE-79) vulnerability in Eclipse Vert.x web. These vulnerabilities affect the Red Hat build of Quarkus 3.20.4.SP1 and have been rated as having an important security impact by Red Hat Product Security. The advisory references the Red Hat errata RHSA-2026:0131 for remediation details.

Successful exploitation of these vulnerabilities could lead to information disclosure, denial of service, and cross-site scripting attacks in applications using the affected Red Hat build of Quarkus 3.20.4.SP1. The issues in lz4-java may expose sensitive data or disrupt service availability, while the Vert.x web vulnerability could allow attackers to execute malicious scripts in the context of a user's browser.

Red Hat has released an updated version of the Red Hat build of Quarkus 3.20.4.SP1 that addresses these vulnerabilities. Users should apply this security update after ensuring all previously released errata relevant to their system have been installed. Detailed instructions for applying the update are available in the Red Hat advisory RHSA-2026:0131 and associated documentation. No additional mitigation steps are indicated beyond applying the official update.