This Red Hat security advisory covers the release of Red Hat build of Quarkus 3.27.4, which includes fixes for five vulnerabilities in Netty components used by Quarkus. The vulnerabilities addressed are: HTTP Header Injection via disabled validation in HttpProxyHandler (CVE-2026-42578), improper DNS domain name constraint enforcement causing high integrity impact (CVE-2026-42579), HTTP request smuggling due to conflicting HTTP/1.0 headers (CVE-2026-42581), incorrect HTTP response parsing leading to data confusion (CVE-2026-42584), and denial of service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587). The advisory indicates these issues are fixed in version 3.27.4 of Red Hat build of Quarkus. The vendor rates the update as important and recommends applying it after ensuring all previous errata are applied. No CVSS scores are provided, and no known exploits in the wild have been reported.

The vulnerabilities impact the integrity and availability of systems running affected versions of Red Hat build of Quarkus. They include risks of HTTP header injection, request smuggling, data confusion from incorrect HTTP response parsing, denial of service through excessive memory allocation, and integrity issues from improper DNS domain name constraint enforcement. These issues could potentially allow attackers to manipulate HTTP traffic or cause service disruption. However, no known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an official security update in Red Hat build of Quarkus version 3.27.4 that addresses these vulnerabilities. Users should apply this update to remediate the issues. Before applying the update, ensure all previously released relevant errata are installed. Follow Red Hat's official guidance for applying updates as detailed in their documentation. No additional mitigation steps are indicated by the vendor.