This Red Hat security advisory (RHSA-2025:1885) addresses three vulnerabilities in Red Hat build of Quarkus 3.15.3.SP1. CVE-2025-24970 involves improper packet validation in io.netty/netty-handler's SslHandler, potentially causing native crashes when using native SSLEngine. CVE-2025-1247 is a request parameter leakage vulnerability in io.quarkus/quarkus-rest caused by shared instance usage. CVE-2025-1634 describes a memory leak in Quarkus RESTEasy Classic triggered by client request timeouts. The advisory provides an update that includes fixes for these issues. Users are advised to apply this update after ensuring all prior relevant errata are installed. No CVSS scores are provided, but the update is rated as important by Red Hat Product Security.

The vulnerabilities can lead to application instability and potential information leakage. Specifically, CVE-2025-24970 may cause native crashes in applications using native SSLEngine, impacting availability. CVE-2025-1247 could allow leakage of request parameters due to shared instances, potentially exposing sensitive data. CVE-2025-1634 results in memory leaks under certain conditions, which can degrade service performance or cause outages. No known exploits in the wild have been reported at this time.

A security update for Red Hat build of Quarkus 3.15.3.SP1 is available that addresses these vulnerabilities. Users should apply this update after confirming that all previously released relevant errata are installed, following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.