RHSA-2026:1899
Vulnerability from csaf_redhat - Published: 2026-02-05 14:43 - Updated: 2026-02-05 20:05Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.20.5 release and security update
Notes
Topic
An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details
This release of Red Hat build of Quarkus 3.20.5 includes the following CVE fixes:
* netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection [quarkus-3.20] (CVE-2025-67735)
* common: Timing Attack Vulnerability in SCRAM Authentication [quarkus-3.20] (CVE-2025-59432)
* quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability [quarkus-3.20] (CVE-2025-66560)
For more information, see the release notes page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.20.5 includes the following CVE fixes:\n\n* netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection [quarkus-3.20] (CVE-2025-67735)\n\n* common: Timing Attack Vulnerability in SCRAM Authentication [quarkus-3.20] (CVE-2025-59432)\n\n* quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability [quarkus-3.20] (CVE-2025-66560)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:1899",
"url": "https://access.redhat.com/errata/RHSA-2026:1899"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.20.5",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.20.5"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.20",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.20"
},
{
"category": "external",
"summary": "QUARKUS-6612",
"url": "https://issues.redhat.com/browse/QUARKUS-6612"
},
{
"category": "external",
"summary": "QUARKUS-6800",
"url": "https://issues.redhat.com/browse/QUARKUS-6800"
},
{
"category": "external",
"summary": "QUARKUS-6939",
"url": "https://issues.redhat.com/browse/QUARKUS-6939"
},
{
"category": "external",
"summary": "QUARKUS-7109",
"url": "https://issues.redhat.com/browse/QUARKUS-7109"
},
{
"category": "external",
"summary": "QUARKUS-7110",
"url": "https://issues.redhat.com/browse/QUARKUS-7110"
},
{
"category": "external",
"summary": "QUARKUS-7111",
"url": "https://issues.redhat.com/browse/QUARKUS-7111"
},
{
"category": "external",
"summary": "QUARKUS-7112",
"url": "https://issues.redhat.com/browse/QUARKUS-7112"
},
{
"category": "external",
"summary": "QUARKUS-7113",
"url": "https://issues.redhat.com/browse/QUARKUS-7113"
},
{
"category": "external",
"summary": "QUARKUS-7114",
"url": "https://issues.redhat.com/browse/QUARKUS-7114"
},
{
"category": "external",
"summary": "QUARKUS-7117",
"url": "https://issues.redhat.com/browse/QUARKUS-7117"
},
{
"category": "external",
"summary": "QUARKUS-7119",
"url": "https://issues.redhat.com/browse/QUARKUS-7119"
},
{
"category": "external",
"summary": "QUARKUS-7120",
"url": "https://issues.redhat.com/browse/QUARKUS-7120"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1899.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.20.5 release and security update",
"tracking": {
"current_release_date": "2026-02-05T20:05:39+00:00",
"generator": {
"date": "2026-02-05T20:05:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.1"
}
},
"id": "RHSA-2026:1899",
"initial_release_date": "2026-02-05T14:43:16+00:00",
"revision_history": [
{
"date": "2026-02-05T14:43:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-02-05T14:43:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-02-05T20:05:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.20.5",
"product": {
"name": "Red Hat build of Quarkus 3.20.5",
"product_id": "Red Hat build of Quarkus 3.20.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.20::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-59432",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2025-09-22T20:00:54.254058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397490"
}
],
"notes": [
{
"category": "description",
"text": "SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ongres-scram: Timing Attack Vulnerability in SCRAM Authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.20.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-59432"
},
{
"category": "external",
"summary": "RHBZ#2397490",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397490"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-59432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432"
},
{
"category": "external",
"summary": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)",
"url": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)"
},
{
"category": "external",
"summary": "https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2",
"url": "https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2"
},
{
"category": "external",
"summary": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537",
"url": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537"
}
],
"release_date": "2025-09-22T19:22:37.117000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-05T14:43:16+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:1899"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ongres-scram: Timing Attack Vulnerability in SCRAM Authentication"
},
{
"cve": "CVE-2025-66560",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2025-12-04T13:15:11.315000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418794"
}
],
"notes": [
{
"category": "description",
"text": "Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products utilizing Quarkus REST, including Red Hat AMQ, Cryostat, Enterprise Application Platform, OpenShift Container Platform, and Red Hat Build of Quarkus. The flaw in the HTTP layer can lead to an application-level denial of service if remote attackers repeatedly drop client connections while response chunks are being transmitted, causing worker threads to become permanently blocked and exhausted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.20.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66560"
},
{
"category": "external",
"summary": "RHBZ#2418794",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418794"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66560",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66560"
}
],
"release_date": "2026-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-05T14:43:16+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:1899"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability"
},
{
"cve": "CVE-2025-67735",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2025-12-16T01:01:30.831342+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2422568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (netty-codec-http). This vulnerability allows request smuggling via CRLF (Carriage Return Line Feed) injection with the request URI when constructing a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. A CRLF injection flaw exists in the `io.netty.handler.codec.http.HttpRequestEncoder` component of Netty. This can lead to request smuggling if applications using `HttpRequestEncoder` do not properly sanitize the request URI, allowing an attacker to inject malicious headers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.20.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67735"
},
{
"category": "external",
"summary": "RHBZ#2422568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67735",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67735"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67735",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67735"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4",
"url": "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4"
}
],
"release_date": "2025-12-16T00:19:11.287000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-05T14:43:16+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:1899"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.20.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…