Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6 release and security update
Red Hat has released an important security update for its build of Quarkus version 3.15.6 addressing two vulnerabilities: CVE-2025-49146, involving insecure authentication in PostgreSQL JDBC channel binding, and CVE-2025-49574, related to a potential data leak in Quarkus. These issues are fixed in the 3.15.6 release. The update is rated as important by Red Hat Product Security. Users should apply this update after ensuring all prior errata are installed.
AI Analysis
Technical Summary
This advisory covers two security vulnerabilities fixed in Red Hat build of Quarkus 3.15.6. CVE-2025-49146 addresses insecure authentication in PostgreSQL JDBC channel binding, categorized under CWE-287 (Improper Authentication). CVE-2025-49574 concerns a potential data leak in Quarkus, related to CWE-668 (Exposure of Resource to Wrong Sphere). Red Hat has released version 3.15.6 of their Quarkus build to remediate these issues. The vendor advisory confirms the availability of this update and recommends applying it after previous errata are applied.
Potential Impact
The vulnerabilities could allow improper authentication and potential data leakage within applications using the affected Quarkus build. This may lead to unauthorized access or exposure of sensitive information. The severity is rated as important (high) by Red Hat, indicating significant security impact but no known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat has provided an official fix in the form of the Red Hat build of Quarkus 3.15.6 update. Users should apply this update to remediate the vulnerabilities. Before applying, ensure all previously released errata relevant to the system are installed. Follow Red Hat's documented update procedures as detailed in their advisory and knowledge base articles.
Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6 release and security update
Description
Red Hat has released an important security update for its build of Quarkus version 3.15.6 addressing two vulnerabilities: CVE-2025-49146, involving insecure authentication in PostgreSQL JDBC channel binding, and CVE-2025-49574, related to a potential data leak in Quarkus. These issues are fixed in the 3.15.6 release. The update is rated as important by Red Hat Product Security. Users should apply this update after ensuring all prior errata are installed.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers two security vulnerabilities fixed in Red Hat build of Quarkus 3.15.6. CVE-2025-49146 addresses insecure authentication in PostgreSQL JDBC channel binding, categorized under CWE-287 (Improper Authentication). CVE-2025-49574 concerns a potential data leak in Quarkus, related to CWE-668 (Exposure of Resource to Wrong Sphere). Red Hat has released version 3.15.6 of their Quarkus build to remediate these issues. The vendor advisory confirms the availability of this update and recommends applying it after previous errata are applied.
Potential Impact
The vulnerabilities could allow improper authentication and potential data leakage within applications using the affected Quarkus build. This may lead to unauthorized access or exposure of sensitive information. The severity is rated as important (high) by Red Hat, indicating significant security impact but no known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat has provided an official fix in the form of the Red Hat build of Quarkus 3.15.6 update. Users should apply this update to remediate the vulnerabilities. Before applying, ensure all previously released errata relevant to the system are installed. Follow Red Hat's documented update procedures as detailed in their advisory and knowledge base articles.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:13012
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-49574"]
Threat ID: 6a3c0cf0eed863c81e238d04
Added to database: 06/24/2026, 16:59:28 UTC
Last enriched: 07/30/2026, 09:22:27 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.