The Red Hat build of Quarkus 3.20.6 release includes security fixes for five vulnerabilities: CVE-2026-33870 (Netty HTTP request smuggling due to incorrect parsing of HTTP/1.1 chunked transfer encoding extension values), CVE-2026-33871 (Netty HTTP/2 CONTINUATION frame flood causing denial of service), CVE-2025-67030 (directory traversal in Plexus-utils extractFile method), CVE-2025-33042 (code injection in Apache Avro Java SDK generated Java code), and CVE-2026-1002 (cache manipulation in Vert.x static handler component causing denial of access to static files). These vulnerabilities affect components integrated into the Red Hat build of Quarkus 3.20.6. The advisory rates the update as important and recommends applying it after all previous errata are installed. No CVSS scores are provided in the advisory.

The vulnerabilities fixed in this update could allow attackers to perform HTTP request smuggling, denial of service attacks via HTTP/2 frame flooding, directory traversal potentially leading to unauthorized file access, code injection through Apache Avro Java SDK generated code, and denial of access to static files by manipulating the Vert.x static handler cache. These issues collectively pose risks of service disruption, unauthorized code execution, and unauthorized file access within applications using the affected Quarkus build.

Red Hat has released an updated build of Quarkus version 3.20.6 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed instructions for applying the update are available in the Red Hat advisory and knowledge base articles. No additional mitigation steps are indicated beyond applying the official update.