This Red Hat security advisory (RHSA-2026:0134) covers a security update for Red Hat build of Quarkus 3.27.1.SP1 that includes fixes for three CVEs: CVE-2025-66566 (lz4-java information disclosure due to insufficient output buffer clearing), CVE-2025-12183 (lz4-java out-of-bounds memory operations causing denial of service and information disclosure), and CVE-2025-11966 (Eclipse Vert.x cross-site scripting vulnerability). The advisory rates the update as important and provides guidance to apply the update after previous errata. No CVSS scores are provided in the advisory.

The vulnerabilities fixed include information disclosure and denial of service risks from lz4-java components and a cross-site scripting vulnerability in vertx-web. These issues could allow attackers to access sensitive information or disrupt service. The advisory does not report any known exploits in the wild. The overall security impact is rated as important by Red Hat.

A security update for Red Hat build of Quarkus 3.27.1.SP1 is available that addresses these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata are installed. Refer to the official Red Hat documentation for detailed update instructions. No additional mitigation steps are indicated by the vendor.