{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.27.2 includes the following CVE fixes:\n\n* common: Timing Attack Vulnerability in SCRAM Authentication [quarkus-3.27] (CVE-2025-59432)\n\n* hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect [quarkus-3.27] (CVE-2025-14969)\n\n* netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection [quarkus-3.27] (CVE-2025-67735)\n\n* quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability [quarkus-3.27] (CVE-2025-66560)\n\nFor more information, see the release notes page listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:1965",
        "url": "https://access.redhat.com/errata/RHSA-2026:1965"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.2"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6243",
        "url": "https://issues.redhat.com/browse/QUARKUS-6243"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6552",
        "url": "https://issues.redhat.com/browse/QUARKUS-6552"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6553",
        "url": "https://issues.redhat.com/browse/QUARKUS-6553"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6564",
        "url": "https://issues.redhat.com/browse/QUARKUS-6564"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6715",
        "url": "https://issues.redhat.com/browse/QUARKUS-6715"
      },
      {
        "category": "external",
        "summary": "QUARKUS-6792",
        "url": "https://issues.redhat.com/browse/QUARKUS-6792"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7028",
        "url": "https://issues.redhat.com/browse/QUARKUS-7028"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7060",
        "url": "https://issues.redhat.com/browse/QUARKUS-7060"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7061",
        "url": "https://issues.redhat.com/browse/QUARKUS-7061"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7062",
        "url": "https://issues.redhat.com/browse/QUARKUS-7062"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7063",
        "url": "https://issues.redhat.com/browse/QUARKUS-7063"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7064",
        "url": "https://issues.redhat.com/browse/QUARKUS-7064"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7065",
        "url": "https://issues.redhat.com/browse/QUARKUS-7065"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7066",
        "url": "https://issues.redhat.com/browse/QUARKUS-7066"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7067",
        "url": "https://issues.redhat.com/browse/QUARKUS-7067"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7070",
        "url": "https://issues.redhat.com/browse/QUARKUS-7070"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7071",
        "url": "https://issues.redhat.com/browse/QUARKUS-7071"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7073",
        "url": "https://issues.redhat.com/browse/QUARKUS-7073"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7074",
        "url": "https://issues.redhat.com/browse/QUARKUS-7074"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7075",
        "url": "https://issues.redhat.com/browse/QUARKUS-7075"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7078",
        "url": "https://issues.redhat.com/browse/QUARKUS-7078"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7079",
        "url": "https://issues.redhat.com/browse/QUARKUS-7079"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7080",
        "url": "https://issues.redhat.com/browse/QUARKUS-7080"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7081",
        "url": "https://issues.redhat.com/browse/QUARKUS-7081"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7086",
        "url": "https://issues.redhat.com/browse/QUARKUS-7086"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7088",
        "url": "https://issues.redhat.com/browse/QUARKUS-7088"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7089",
        "url": "https://issues.redhat.com/browse/QUARKUS-7089"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7090",
        "url": "https://issues.redhat.com/browse/QUARKUS-7090"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7095",
        "url": "https://issues.redhat.com/browse/QUARKUS-7095"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7098",
        "url": "https://issues.redhat.com/browse/QUARKUS-7098"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7101",
        "url": "https://issues.redhat.com/browse/QUARKUS-7101"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7105",
        "url": "https://issues.redhat.com/browse/QUARKUS-7105"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7107",
        "url": "https://issues.redhat.com/browse/QUARKUS-7107"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1965.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.2 release and security update",
    "tracking": {
      "current_release_date": "2026-03-24T13:18:45+00:00",
      "generator": {
        "date": "2026-03-24T13:18:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2026:1965",
      "initial_release_date": "2026-02-05T14:53:30+00:00",
      "revision_history": [
        {
          "date": "2026-02-05T14:53:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-05T14:53:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-24T13:18:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.27.2",
                "product": {
                  "name": "Red Hat build of Quarkus 3.27.2",
                  "product_id": "Red Hat build of Quarkus 3.27.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.27::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14969",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2025-12-19T10:48:23.311000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat Build of Quarkus. When an application built with Quarkus 3.27 uses Hibernate Reactive and exposes an HTTP endpoint for database operations, a remote client can cause an application level denial of service by prematurely closing the HTTP connection, leading to database connection pool exhaustion. Other Red Hat products, including Enterprise Application Platform and Red Hat OpenShift Dev Spaces, are not affected as the vulnerable code is not present.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14969"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14969",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14969"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14969",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14969"
        }
      ],
      "release_date": "2025-12-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T14:53:30+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1965"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hibernate-reactive-core: Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect"
    },
    {
      "cve": "CVE-2025-59432",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2025-09-22T20:00:54.254058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2397490"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ongres-scram: Timing Attack Vulnerability in SCRAM Authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-59432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2397490",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397490"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-59432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-59432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432"
        },
        {
          "category": "external",
          "summary": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)",
          "url": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)"
        },
        {
          "category": "external",
          "summary": "https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2",
          "url": "https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2"
        },
        {
          "category": "external",
          "summary": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537",
          "url": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537"
        }
      ],
      "release_date": "2025-09-22T19:22:37.117000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T14:53:30+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1965"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ongres-scram: Timing Attack Vulnerability in SCRAM Authentication"
    },
    {
      "cve": "CVE-2025-66560",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2025-12-04T13:15:11.315000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418794"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Quarkus REST HTTP layer. This vulnerability allows remote attackers to cause an application level denial of service by repeatedly dropping client connections while response chunks are being transmitted, leading to worker thread exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products utilizing Quarkus REST, including Red Hat AMQ, Cryostat, Enterprise Application Platform, OpenShift Container Platform, and Red Hat Build of Quarkus. The flaw in the HTTP layer can lead to an application-level denial of service if remote attackers repeatedly drop client connections while response chunks are being transmitted, causing worker threads to become permanently blocked and exhausted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66560"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418794",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418794"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66560",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66560"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66560",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66560"
        }
      ],
      "release_date": "2026-01-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T14:53:30+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1965"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability"
    },
    {
      "cve": "CVE-2025-67735",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2025-12-16T01:01:30.831342+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2422568"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty (netty-codec-http). This vulnerability allows request smuggling via CRLF (Carriage Return Line Feed) injection with the request URI when constructing a request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. A CRLF injection flaw exists in the `io.netty.handler.codec.http.HttpRequestEncoder` component of Netty. This can lead to request smuggling if applications using `HttpRequestEncoder` do not properly sanitize the request URI, allowing an attacker to inject malicious headers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-67735"
        },
        {
          "category": "external",
          "summary": "RHBZ#2422568",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422568"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-67735",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-67735"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67735",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67735"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4"
        }
      ],
      "release_date": "2025-12-16T00:19:11.287000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T14:53:30+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1965"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection"
    }
  ]
}