This advisory covers security fixes in Red Hat build of Quarkus 3.8.6.SP3. The first vulnerability (CVE-2025-24970) involves improper packet validation in io.netty/netty-handler's SslHandler, potentially causing native crashes when using native SSLEngine. The second (CVE-2025-1247) is a request parameter leakage in Quarkus REST endpoints caused by shared instance usage. The third (CVE-2025-1634) is a memory leak in Quarkus RESTEasy Classic triggered by client request timeouts. Red Hat has issued an important security update addressing these issues. No CVSS scores are provided, but the vendor rates the impact as important. Users should apply the update following Red Hat's guidance.

The vulnerabilities can lead to application instability via native crashes (CVE-2025-24970), potential leakage of request parameters in REST endpoints (CVE-2025-1247), and resource exhaustion due to memory leaks on client request timeouts (CVE-2025-1634). These issues affect the security and reliability of applications using the affected Quarkus components. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the Red Hat build of Quarkus 3.8.6.SP3 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available at Red Hat's official documentation: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.