This Red Hat security advisory covers three vulnerabilities fixed in Red Hat build of Quarkus 3.15.3.SP1. CVE-2025-24970 involves io.netty/netty-handler's SslHandler not correctly validating packets, which can cause a native crash when using native SSLEngine. CVE-2025-1247 is a request parameter leakage in Quarkus REST endpoints due to shared instance usage. CVE-2025-1634 is a memory leak in Quarkus RESTEasy Classic triggered when client requests timeout. The advisory recommends applying the update after prior errata and backing up systems. No CVSS scores are provided. No known exploits in the wild have been reported.

The vulnerabilities can lead to a native crash of applications using native SSLEngine (CVE-2025-24970), leakage of request parameters in REST endpoints potentially exposing sensitive data (CVE-2025-1247), and memory leaks in RESTEasy Classic that could degrade service availability (CVE-2025-1634). These issues collectively pose a high security risk affecting the stability and confidentiality of applications built on the affected Quarkus versions.

Red Hat has released an official security update for Red Hat build of Quarkus 3.15.3.SP1 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems are installed. It is recommended to back up existing installations, including applications and configurations, before applying the update. No additional mitigations or workarounds are indicated in the vendor advisory.