The Red Hat build of Quarkus 3.8.6 release includes security fixes for CVE-2024-3653, which involves the undertow LearningPushHandler potentially leading to remote memory DoS attacks, and CVE-2024-8391, where the Vertx gRPC client and server do not limit maximum message sizes, potentially allowing resource exhaustion. These issues are part of a broader update that also addresses other bugs and improvements. The Red Hat advisory RHSA-2024:6437 details these fixes and recommends updating to the patched version. The update is rated as having a moderate security impact. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities fixed in this update could allow remote attackers to cause denial-of-service conditions by exhausting memory resources via the undertow LearningPushHandler or by sending oversized messages to the Vertx gRPC server or client. This could degrade service availability or cause application crashes. The overall security impact is rated moderate by Red Hat. No active exploitation has been reported.

Red Hat has released an official security update for the Red Hat build of Quarkus 3.8.6 that addresses these vulnerabilities. Users should apply this update following Red Hat's guidance and ensure all previously released errata are applied before updating. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patch.