Red Hat Security Advisory

RHSA-2026:1899

Red Hat build of Quarkus 3.20.5 release and security update

Released 2026-02-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat build of Quarkus 3.20.5.redhat com.ongres.scram.scram-common-3.2.0.redhat-00001.jar, io.netty.netty-codec-http-4.1.130.Final-redhat-00001.jar, io.quarkus.quarkus-rest-3.20.5.redhat-00001.jar

Fixes 3 records

TI-2025-41431 CVE-2025-67735 · GHSA-84h7-rjj3-6jx4

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

HIGH 68

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0032 Published 2025-12-16 Partial fix · 4.2.8.Final, 4.1.129.Final CWE-93

TI-2025-36984 CVE-2025-59432 · GHSA-3wfh-36rx-9537

Timing Attack Vulnerability in SCRAM Authentication

LOW 36

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00702 Published 2025-09-22 Partial fix · 3.2 CWE-208

TI-2025-40971 CVE-2025-66560 · GHSA-5rfx-cp42-p624

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

LOW 33

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00383 Published 2026-01-07 Partial fix · 3.31.0, 3.27.2 +1 CWE-770