RHSA-2026:54776
Vulnerability from csaf_redhat - Published: 2026-08-13 23:28 - Updated: 2026-08-13 23:41Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)
Severity
Important
Notes
Topic: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of Important.
Details: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:
* sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation [rhboac-camel-quarkus-3] (CVE-2026-56624)
* libthrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation [rhboac-camel-quarkus-3] (CVE-2026-45112)
* libthrift: Apache Thrift: Denial of Service via improper handling of highly compressed data [rhboac-camel-quarkus-3] (CVE-2026-48586)
* org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF [rhboac-camel-quarkus-3] (CVE-2026-55471)
* org.hl7.fhir.dstu2: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module [rhboac-camel-quarkus-3] (CVE-2026-55470)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability (CVE-2026-45367) was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches() function in org.hl7.fhir.dstu2 did not include protection against regular expression timeouts. This allows an unauthenticated attacker to submit a specially crafted FHIRPath expression, triggering catastrophic regular expression (regex) backtracking. The consequence is a Regular Expression Denial of Service (ReDoS), which can exhaust server CPU resources and lead to service disruption.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the HAPI FHIR `XsltUtilities` component. The `saxonTransform` functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious XML External Entities (XXE). Successful exploitation can lead to local file disclosure, enabling the attacker to read sensitive files from the system. Additionally, it can result in Server-Side Request Forgery (SSRF), where the attacker can force the system to make requests to arbitrary network resources, potentially exposing internal network information or cloud metadata.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
44 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Important.",
"title": "Topic"
},
{
"category": "general",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation [rhboac-camel-quarkus-3] (CVE-2026-56624)\n* libthrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation [rhboac-camel-quarkus-3] (CVE-2026-45112)\n* libthrift: Apache Thrift: Denial of Service via improper handling of highly compressed data [rhboac-camel-quarkus-3] (CVE-2026-48586)\n* org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF [rhboac-camel-quarkus-3] (CVE-2026-55471)\n* org.hl7.fhir.dstu2: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module [rhboac-camel-quarkus-3] (CVE-2026-55470)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54776",
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45112",
"url": "https://access.redhat.com/security/cve/CVE-2026-45112"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48586",
"url": "https://access.redhat.com/security/cve/CVE-2026-48586"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55471",
"url": "https://access.redhat.com/security/cve/CVE-2026-55471"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55470",
"url": "https://access.redhat.com/security/cve/CVE-2026-55470"
},
{
"category": "external",
"summary": "2498308",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498308"
},
{
"category": "external",
"summary": "2498310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498310"
},
{
"category": "external",
"summary": "2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "2507434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
},
{
"category": "external",
"summary": "2507439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507439"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54776.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)",
"tracking": {
"current_release_date": "2026-08-13T23:41:41+00:00",
"generator": {
"date": "2026-08-13T23:41:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:54776",
"initial_release_date": "2026-08-13T23:28:22+00:00",
"revision_history": [
{
"date": "2026-08-13T23:28:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-13T23:28:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T23:41:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product": {
"name": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product_id": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_quarkus:3.33"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-45112",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-27T12:01:28.483023+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507439"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It stems from uncontrolled resource allocation in Apache Thrift Java bindings, which can lead to a denial of service. This impacts Red Hat products such as Red Hat OpenShift AI, Red Hat build of Apache Camel, Red Hat Ceph Storage, Red Hat Connectivity Link, and Cryostat, where services utilizing these vulnerable bindings could experience resource exhaustion and service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45112"
},
{
"category": "external",
"summary": "RHBZ#2507439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45112"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45112",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45112"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/24/34",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/34"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc",
"url": "https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc"
}
],
"release_date": "2026-07-27T10:57:34.326000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T23:28:22+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-48586",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-27T12:01:11.736259+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507434"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Thrift\u0027s handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48586"
},
{
"category": "external",
"summary": "RHBZ#2507434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48586"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/24/37",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq",
"url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
}
],
"release_date": "2026-07-27T11:02:54.430000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T23:28:22+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data"
},
{
"cve": "CVE-2026-55470",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-07-08T22:02:51.594003+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498308"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability (CVE-2026-45367) was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches() function in org.hl7.fhir.dstu2 did not include protection against regular expression timeouts. This allows an unauthenticated attacker to submit a specially crafted FHIRPath expression, triggering catastrophic regular expression (regex) backtracking. The consequence is a Regular Expression Denial of Service (ReDoS), which can exhaust server CPU resources and lead to service disruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important because an unauthenticated, remote attacker can exploit an incomplete patch in the HAPI FHIR DSTU2 module. By submitting a specially crafted FHIRPath expression, an attacker can trigger a Regular Expression Denial of Service (ReDoS) attack, leading to significant resource exhaustion and service unavailability on affected systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55470"
},
{
"category": "external",
"summary": "RHBZ#2498308",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498308"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55470"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55470",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55470"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc27ee1ab030e590",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc27ee1ab030e590"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5"
}
],
"release_date": "2026-07-08T21:27:34.034000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T23:28:22+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module"
},
{
"cve": "CVE-2026-55471",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2026-07-08T22:02:54.662798+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498310"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HAPI FHIR `XsltUtilities` component. The `saxonTransform` functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious XML External Entities (XXE). Successful exploitation can lead to local file disclosure, enabling the attacker to read sensitive files from the system. Additionally, it can result in Server-Side Request Forgery (SSRF), where the attacker can force the system to make requests to arbitrary network resources, potentially exposing internal network information or cloud metadata.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca.uhn.hapi.fhir/org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in HAPI FHIR `XsltUtilities` that allows XML External Entity (XXE) injection. An unauthenticated, remote attacker can exploit this by providing specially crafted XML data to disclose local files or perform Server-Side Request Forgery (SSRF). This is critical in environments where Red Hat products, such as Enterprise Application Platform or Red Hat build of Apache Camel, process untrusted XML input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55471"
},
{
"category": "external",
"summary": "RHBZ#2498310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498310"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55471"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55471",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55471"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/01ca2ecdefec9b33204d2495fe78af8c0dc52298"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10"
},
{
"category": "external",
"summary": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf"
}
],
"release_date": "2026-07-08T21:28:45.390000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T23:28:22+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ca.uhn.hapi.fhir/org.hl7.fhir.utilities: HAPI FHIR XsltUtilities: XML External Entity injection allows local file disclosure and SSRF"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T23:28:22+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54776"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…