This advisory covers a security update for Red Hat Streams for Apache Kafka 3.1.0 that addresses twelve CVEs affecting Apache Kafka and its ecosystem components. Key issues include Netty's BrotliDecoder vulnerability to DoS via zip bomb (CVE-2025-58057), request smuggling in Netty (CVE-2025-58056), HTTP/2 DDoS vulnerability (CVE-2025-55163), uncontrolled recursion in Apache Commons Lang3 (CVE-2025-48924), memory leak in Quarkus RESTEasy (CVE-2025-1634), data leak in Quarkus Vert.x (CVE-2025-49574), SCRAM authentication replay attacks without encryption (CVE-2024-56128), Kafka client SSRF and arbitrary file read vulnerabilities (CVE-2025-27817, CVE-2025-27818, CVE-2025-27819), and Vert.x access control and XSS flaws (CVE-2025-11965, CVE-2025-11966). The update replaces version 3.0.1 and includes security, bug fixes, and enhancements.

The vulnerabilities collectively could allow denial of service, replay attacks on authentication, remote code execution, information disclosure, request smuggling, SSRF, arbitrary file read, access control bypass, and cross-site scripting. These issues affect multiple components used by Red Hat Streams for Apache Kafka, potentially impacting the confidentiality, integrity, and availability of affected deployments if exploited. Red Hat rates the overall security impact as Moderate.

Red Hat has released Streams for Apache Kafka 3.1.0 as a replacement for 3.0.1, which includes fixes for all listed vulnerabilities. Users should apply this update after ensuring all previous relevant errata are installed. Detailed update instructions are available from Red Hat's customer portal. No additional vendor advisories indicate that no action is required or that issues are already mitigated; therefore, applying the update is the recommended remediation.