The Red Hat build of Quarkus 3.27.2 release includes fixes for four specific vulnerabilities: CVE-2025-59432 (timing attack in SCRAM authentication), CVE-2025-14969 (denial of service caused by connection leaks on HTTP client disconnect in Hibernate Reactive), CVE-2025-67735 (HTTP request smuggling via CRLF injection in Netty codec HTTP), and CVE-2025-66560 (worker thread exhaustion vulnerability in Quarkus REST). These vulnerabilities affect components within the Quarkus runtime and related libraries. The advisory indicates that the update addresses these issues and recommends applying the update after ensuring prior errata are applied.

The vulnerabilities fixed in this update could allow attackers to perform timing attacks on authentication mechanisms, cause denial of service through connection leaks, conduct HTTP request smuggling attacks, and exhaust worker threads leading to service disruption. These impacts can degrade service availability and potentially expose sensitive authentication timing information. Red Hat rates the overall security impact as moderate.

Red Hat recommends applying the Quarkus 3.27.2 update which includes fixes for these vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available at Red Hat's official documentation. No indication of alternative mitigations or workarounds is provided, so applying the official update is the primary remediation.