This advisory covers two security vulnerabilities fixed in Red Hat build of Quarkus 3.15.6. CVE-2025-49146 addresses insecure authentication in PostgreSQL JDBC channel binding, classified under CWE-287 (Improper Authentication). CVE-2025-49574 relates to a potential data leak in Quarkus, associated with CWE-668 (Exposure of Resource to Wrong Sphere). Red Hat has issued this update to remediate these issues and recommends applying it after ensuring all previous errata are installed. No CVSS score is provided, but the update is rated as having an important security impact.

The vulnerabilities could allow improper authentication in PostgreSQL JDBC connections and potential data leakage within Quarkus applications, which may lead to unauthorized access or exposure of sensitive information. The severity is rated as important by Red Hat, indicating a high risk if left unpatched.

Red Hat has released version 3.15.6 of its build of Quarkus containing fixes for these vulnerabilities. Users should apply this update after confirming all prior relevant errata are installed. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.