The Red Hat build of Quarkus 3.27.1 release includes a fix for CVE-2025-64518, which is an XML External Entity (XXE) injection vulnerability in the CycloneDX Core Java library's BOM validation process. This vulnerability could allow an attacker to exploit XML parsing to access unauthorized data or cause denial of service. The advisory rates the security impact as moderate and recommends updating to the fixed version 3.27.1. The update also includes various other fixes unrelated to this vulnerability. No CVSS score is provided in the advisory.

The vulnerability allows XML External Entity injection during BOM validation, which can lead to exposure of sensitive data or denial of service conditions. The Red Hat advisory rates the security impact as moderate. There are no known exploits in the wild at this time.

Red Hat has released an official security update in Red Hat build of Quarkus version 3.27.1 that addresses this vulnerability. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available in the Red Hat advisory. No additional mitigation steps are indicated or required beyond applying the official update.