The Red Hat build of Quarkus 3.15.7 release includes fixes for two vulnerabilities in the Netty library. CVE-2025-58056 is a request smuggling vulnerability caused by improper parsing of HTTP chunk extensions in netty-codec-http. CVE-2025-58057 is a denial of service vulnerability in netty-codec's BrotliDecoder, which can be triggered by a zip bomb style attack. Red Hat has rated the update as having an important security impact and recommends applying the update after ensuring all previous errata are applied. The advisory references the update as RHSA-2025:17187 and provides links for applying the update and additional documentation.

Successful exploitation of CVE-2025-58056 could allow an attacker to perform HTTP request smuggling attacks, potentially bypassing security controls or interfering with request handling. CVE-2025-58057 could allow an attacker to cause a denial of service by triggering resource exhaustion in the BrotliDecoder via a specially crafted compressed payload. Both vulnerabilities affect the Red Hat build of Quarkus 3.15.7 and related Netty components. No known exploits in the wild have been reported at this time.

Red Hat has released an updated version of the Red Hat build of Quarkus 3.15.7 that addresses these vulnerabilities. Users should apply this update to remediate the issues. Before applying the update, ensure all previously released errata relevant to your system have been applied. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor advisory.