The Red Hat build of Quarkus 3.27.1.SP1 security update addresses three vulnerabilities: CVE-2025-66566 and CVE-2025-12183 in lz4-java, which involve information disclosure due to insufficient output buffer clearing and out-of-bounds memory operations leading to denial of service and information disclosure, respectively; and CVE-2025-11966 in vertx-web, an Eclipse Vert.x component, which is a cross-site scripting vulnerability. Red Hat rates the update as important and recommends applying it after prior errata. No CVSS scores are provided in the advisory.

Successful exploitation of the lz4-java vulnerabilities could lead to information disclosure and denial of service conditions. The vertx-web vulnerability could allow cross-site scripting attacks, potentially enabling attackers to execute malicious scripts in the context of affected applications. These vulnerabilities collectively impact confidentiality and availability, as well as potentially client-side security via XSS.

Red Hat has released an official security update for the Red Hat build of Quarkus 3.27.1.SP1 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system are installed. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated or required beyond applying the update.