This security advisory covers three vulnerabilities fixed in Red Hat build of Quarkus 3.27.1.SP1: CVE-2025-66566, an information disclosure issue caused by insufficient output buffer clearing in lz4-java; CVE-2025-12183, an out-of-bounds memory operation in lz4-java leading to denial of service and information disclosure; and CVE-2025-11966, a cross-site scripting vulnerability in Eclipse Vert.x web. The advisory is issued by Red Hat Product Security and classified as important. No CVSS scores are provided, but the vulnerabilities affect memory safety and web security components within the Quarkus runtime environment.

The vulnerabilities fixed in this update could allow attackers to cause denial of service and gain unauthorized access to information through memory handling flaws in the lz4-java library, as well as execute cross-site scripting attacks via the Eclipse Vert.x web component. These issues could impact applications built on the affected Quarkus version, potentially compromising confidentiality and availability.

Red Hat has released an official security update for Red Hat build of Quarkus 3.27.1.SP1 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available in the Red Hat advisory and documentation. No additional mitigation steps are indicated beyond applying the official update.