Red Hat Security Advisory

RHSA-2025:17563

Red Hat build of Quarkus 3.20.3 release and security update

Released 2025-10-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.20.3.redhat io.netty.netty-codec-4.1.127.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.127.Final-redhat-00001.jar

Fixes 2 records

TI-2025-35900 CVE-2025-58057 · GHSA-3p8m-j85q-pgmj

Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

MEDIUM 64

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00631 Published 2025-09-03 Partial fix · 4.2.5.Final, 4.1.125.Final CWE-409

TI-2025-35899 CVE-2025-58056 · GHSA-fghv-69vj-qj49

Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

LOW 16

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0071 Published 2025-09-03 Partial fix · 4.2.5.Final, 4.1.125.Final CWE-444