Threats Tagged 'cve-2025-11966'

This release of Red Hat build of Quarkus 3.27.1.SP1 includes the following CVE fixes: * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing [quarkus-3.27] (CVE-2025-66566) * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure [quarkus-3.27] (CVE-2025-12183) * vertx-web: Eclipse Vert.x cross site scripting [quarkus-3.27] (CVE-2025-11966) For more information, see the release notes page listed in the References section.

This release of Red Hat build of Quarkus 3.20.4.SP1 includes the following CVE fixes: * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing [quarkus-3.20] (CVE-2025-66566) * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure [quarkus-3.20] (CVE-2025-12183) * vertx-web: Eclipse Vert.x cross site scripting [quarkus-3.20 (CVE-2025-11966) For more information, see the release notes page listed in the References section.

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.1.0 serves as a replacement for Red Hat Streams for Apache Kafka 3.0.1, and includes security and bug fixes, and enhancements. Security Fix(es): * Apache Kafka, Drain Cleaner, Bridge, Cruise Conreol, Proxy, Console: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack"(CVE-2025-58057)" * Apache Kafka, Proxy: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions"(CVE-2025-58056)" * Apache Kafka, Bridge, Drain Cleaner, Cruise Control, Console: Netty MadeYouReset HTTP/2 DDoS Vulnerability ("CVE-2025-55163") * Apache Kafka: org.apache.commons:commons-lang3 : Uncontrolled Recursion("CVE-2025-48924") * Drain Cleaner: io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout("CVE-2025-1634") * Drain Cleaner, Console: Data leak vulnerability in io.quarkus:quarkus-vertx package ("CVE-2025-49574") * Cruise Control: org.apache.kafka/kafka_2.13: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption (" CVE-2024-56128") * Cruise Control: org.apache.kafka: Kafka Client Arbitrary File Read SSRF("CVE-2025-27817") * Cruise Control: Kafka Clients Vulnerabiliy("CVE-2025-27819") * Cruise Control: Kafka Clients Vulnerabiliy("CVE-2025-27818") * Cruise Control, Console: io.vertx/vertx-core: Eclipse Vert.x Access Control Flaw ("CVE-2025-11965") * Cruise Control, Console: Vertx - Cross-site scripting (XSS) vulnerability ("CVE-2025-11966")

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

LowVulnerabilityGermanyFranceUnited Kingdom+2#cve#cve-2025-11966#cwe-79