The Red Hat build of Quarkus 3.20.6 release includes fixes for five distinct vulnerabilities: CVE-2026-33870 (Netty HTTP request smuggling due to incorrect parsing of HTTP/1.1 chunked transfer encoding extension values), CVE-2026-33871 (Netty HTTP/2 denial of service via CONTINUATION frame flood), CVE-2025-67030 (directory traversal in Plexus-utils extractFile method), CVE-2025-33042 (code injection in Apache Avro Java SDK generated Java code), and CVE-2026-1002 (manipulation of Vert.x static handler cache causing denial of access to static files). These vulnerabilities affect the Red Hat build of Quarkus prior to and including version 3.20.6. The advisory confirms that patches are available in this release to remediate these issues.

Successful exploitation of these vulnerabilities could allow attackers to perform HTTP request smuggling, cause denial of service conditions, execute code injection attacks, or access files improperly via directory traversal. These impacts can compromise application reliability, security, and data integrity in environments using the affected Quarkus build versions.

A security update to Red Hat build of Quarkus version 3.20.6 is available and should be applied to remediate these vulnerabilities. Before applying this update, ensure all previously released relevant errata are installed. Follow Red Hat's official guidance for applying the update as detailed in their advisory and documentation. No additional mitigation steps are indicated beyond applying the official patch.