This security advisory covers Red Hat Integration - Service Registry version 2.5.11 GA, which addresses five security vulnerabilities: CVE-2024-25710 (denial of service via infinite loop in commons-compress when processing corrupted DUMP files), CVE-2024-1023 (memory leak in vert.x due to Netty FastThreadLocal usage), CVE-2024-1300 (memory leak in vert.x when TCP server is configured with TLS and SNI), CVE-2024-26308 (OutOfMemoryError unpacking broken Pack200 files in commons-compress), and CVE-2024-29025 (resource allocation without limits or throttling in netty-codec-http). These issues could cause denial of service or resource exhaustion. The advisory does not provide CVSS scores but classifies the impact as moderate. The update is delivered as container image updates and requires applying this update along with any previously released errata.

The vulnerabilities fixed in this release can lead to denial of service conditions through infinite loops or memory leaks, potentially causing service disruption or resource exhaustion in affected deployments of Red Hat Integration - Service Registry 2.5.11 GA. There is no indication of remote code execution or data confidentiality impacts in the advisory. The overall security impact is rated moderate by Red Hat Product Security.

A security update to Red Hat Integration - Service Registry 2.5.11 GA is available that addresses these vulnerabilities. Users should apply this update by obtaining the updated container images from the Red Hat Container Catalog. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official documentation and advisories for detailed update instructions. No alternative mitigations or workarounds are specified.