Red Hat Security Advisory: Red Hat build of Quarkus 3.27.1 release and security update
Red Hat has released a security update for Red Hat build of Quarkus 3.27.1 addressing a vulnerability in the CycloneDX Core Java library. The vulnerability (CVE-2025-64518) involves XML External Entity (XXE) injection during BOM validation. This update mitigates the risk by fixing the XXE injection issue. The advisory rates the security impact as Moderate. Users should apply the update following Red Hat's guidance to remediate the vulnerability.
AI Analysis
Technical Summary
The Red Hat build of Quarkus 3.20.4 release includes a fix for CVE-2025-64518, which is an XML External Entity (XXE) injection vulnerability in the CycloneDX Core Java library's BOM validation functionality. This vulnerability is categorized under CWE-611. The advisory references Red Hat's errata RHSA-2025:22195 and indicates that the update addresses this issue in the Quarkus 3.20.4 release. No CVSS score is provided, but Red Hat rates the impact as Moderate. The update is available and users should apply it following Red Hat's update procedures.
Potential Impact
The vulnerability allows XML External Entity injection during BOM validation in the CycloneDX Core Java library used by Red Hat build of Quarkus. This could potentially lead to exposure of sensitive data or other impacts associated with XXE vulnerabilities. Red Hat rates the security impact as Moderate. There are no known exploits in the wild at this time.
Mitigation Recommendations
A security update for Red Hat build of Quarkus 3.20.4 is available that addresses CVE-2025-64518. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Follow Red Hat's official guidance for applying updates: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.1 release and security update
Description
Red Hat has released a security update for Red Hat build of Quarkus 3.27.1 addressing a vulnerability in the CycloneDX Core Java library. The vulnerability (CVE-2025-64518) involves XML External Entity (XXE) injection during BOM validation. This update mitigates the risk by fixing the XXE injection issue. The advisory rates the security impact as Moderate. Users should apply the update following Red Hat's guidance to remediate the vulnerability.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat build of Quarkus 3.20.4 release includes a fix for CVE-2025-64518, which is an XML External Entity (XXE) injection vulnerability in the CycloneDX Core Java library's BOM validation functionality. This vulnerability is categorized under CWE-611. The advisory references Red Hat's errata RHSA-2025:22195 and indicates that the update addresses this issue in the Quarkus 3.20.4 release. No CVSS score is provided, but Red Hat rates the impact as Moderate. The update is available and users should apply it following Red Hat's update procedures.
Potential Impact
The vulnerability allows XML External Entity injection during BOM validation in the CycloneDX Core Java library used by Red Hat build of Quarkus. This could potentially lead to exposure of sensitive data or other impacts associated with XXE vulnerabilities. Red Hat rates the security impact as Moderate. There are no known exploits in the wild at this time.
Mitigation Recommendations
A security update for Red Hat build of Quarkus 3.20.4 is available that addresses CVE-2025-64518. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Follow Red Hat's official guidance for applying updates: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:22622
- Cve Count
- 1
Threat ID: 6a2857958dd33fbd856ad280
Added to database: 06/09/2026, 18:12:37 UTC
Last enriched: 07/30/2026, 09:29:42 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.