This advisory covers three security vulnerabilities fixed in Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 and Red Hat build of Quarkus 3.8.6.SP3. CVE-2025-1247 involves request parameter leakage in Quarkus REST endpoints due to shared instance misuse. CVE-2025-1634 is a memory leak in Quarkus RESTEasy Classic triggered when client requests timeout. CVE-2025-24970 concerns io.netty's SslHandler, which does not correctly validate packets, potentially causing native crashes when using native SSLEngine. Red Hat has released updates (RHBQ 3.15.3.SP1 and 3.8.6.SP3) that address these vulnerabilities. The vendor rates the security impact as important and provides guidance to apply these updates after ensuring all prior errata are applied.

The vulnerabilities may lead to resource exhaustion due to memory leaks, leakage of request parameters which could expose sensitive data, and native crashes in SSL handling that could disrupt service availability. These issues affect the security and stability of applications built on the affected Red Hat builds of Apache Camel and Quarkus. No known exploits in the wild have been reported at this time.

Red Hat has released official updates (RHBQ 3.15.3.SP1 for Apache Camel 4.8 for Quarkus 3.15 and 3.8.6.SP3 for Red Hat build of Quarkus) that fix these vulnerabilities. Users should apply these updates promptly after backing up their existing installations, including applications, configuration files, and databases. Prior errata relevant to the system should be applied before updating. No additional mitigations are specified by the vendor.