Red Hat Streams for Apache Kafka 3.0.1 is a security update replacing version 3.0.0, addressing two vulnerabilities: CVE-2025-48924, an uncontrolled recursion vulnerability in the Apache Commons Lang3 library used by Kafka, and CVE-2025-55163, a denial-of-service vulnerability in the Netty HTTP/2 codec (netty-codec-http2) known as 'Netty MadeYouReset'. These vulnerabilities could potentially impact the stability and availability of the Kafka streaming platform. Red Hat rates the update as having a Moderate security impact. The advisory recommends applying this update after ensuring all previous errata are applied. No exploits are known in the wild at the time of the advisory.

The vulnerabilities addressed could lead to denial-of-service conditions: CVE-2025-48924 involves uncontrolled recursion in Apache Commons Lang3, potentially causing application instability or crashes. CVE-2025-55163 is an HTTP/2 DDoS vulnerability in Netty's codec that could allow attackers to disrupt service availability. The overall impact is a potential degradation or interruption of Kafka streaming services relying on these components.

Red Hat has released Streams for Apache Kafka 3.0.1 as a replacement for version 3.0.0, which includes fixes for these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available at the Red Hat Customer Portal. No additional mitigations are specified or required beyond applying this official update.