Red Hat has released security updates for its build of Quarkus, specifically versions 3.27.4 and 3.33.2, which address multiple vulnerabilities in the Netty components used by Quarkus. The fixed issues include CVE-2026-42578 (HTTP Header Injection via HttpProxyHandler Disabled Validation), CVE-2026-42581 (HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers), CVE-2026-42584 (Incorrect HTTP response parsing leading to data confusion), CVE-2026-42587 (Denial of Service via unbounded memory allocation in HTTP content decompression), and CVE-2026-42579 (High integrity impact due to improper DNS domain name constraint enforcement). These vulnerabilities affect the Netty handler-proxy, codec-http, codec-http2, and codec-dns components within Quarkus. The advisories recommend updating to the fixed versions to resolve these issues.

The vulnerabilities collectively pose risks including HTTP header injection, HTTP request smuggling, data confusion from incorrect HTTP response parsing, denial of service through excessive memory consumption, and integrity issues related to DNS domain name constraints. These could potentially allow attackers to manipulate HTTP traffic, cause service disruptions, or compromise data integrity. Red Hat rates the security impact of these issues as Important (high). There are no known exploits in the wild at the time of the advisory.

Red Hat has released official fixes in Red Hat build of Quarkus versions 3.27.4 and 3.33.2. Users should apply these updates to remediate the vulnerabilities. Before applying these updates, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official patches.