This advisory covers two vulnerabilities fixed in Red Hat build of Quarkus 3.20.3. CVE-2025-58056 is a request smuggling vulnerability in Netty's HTTP/2 and HTTP codec modules caused by incorrect parsing of chunk extensions. CVE-2025-58057 is a denial-of-service vulnerability in Netty's BrotliDecoder due to zip bomb style attacks. The update includes these fixes and other component version bumps to improve security and stability. Red Hat rates the security impact as moderate and recommends applying the update after ensuring all prior errata are applied.

Successful exploitation of CVE-2025-58056 could allow an attacker to perform HTTP request smuggling attacks, potentially bypassing security controls or interfering with HTTP traffic processing. CVE-2025-58057 could allow denial-of-service conditions via specially crafted compressed data causing resource exhaustion. Both vulnerabilities affect the underlying Netty components used in the Red Hat build of Quarkus 3.20.3, impacting applications relying on this runtime. No known exploits in the wild have been reported at this time.

A security update for Red Hat build of Quarkus 3.20.3 is available that addresses these vulnerabilities. Red Hat advises applying this update after ensuring all previously released errata relevant to your system have been applied. Detailed update instructions are available in the Red Hat advisory RHSA-2025:17563 and related documentation. No alternative mitigations or workarounds are specified.