CVE-2025-24970 is a vulnerability in the io.netty/netty-handler component used by Red Hat build of Quarkus. The SslHandler does not correctly validate packets, which can cause a native crash when the native SSLEngine is used. Red Hat has fixed this issue in the Quarkus 3.20.1 release. The advisory references Red Hat Integration Camel K 1.10.10 as also affected and updated. The vulnerability is classified under CWE-20 (Improper Input Validation). No CVSS score is provided, but Red Hat rates the security impact as Important. The vendor advisory confirms the availability of an official fix in version 3.20.1.

The vulnerability can cause a native crash in applications using the affected versions of Red Hat build of Quarkus when the native SSLEngine is employed. This may lead to denial of service conditions. No known exploits in the wild have been reported. The impact is rated as important by Red Hat, indicating a high severity but not critical.

Red Hat has released an official fix in Red Hat build of Quarkus version 3.20.1. Users should update to this version or later to remediate the vulnerability. Before applying the update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance on applying updates as detailed in their knowledge base article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.