RHSA-2026:71675
Vulnerability from csaf_redhat - Published: 2026-09-24 19:56 - Updated: 2026-09-25 21:00Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
Severity
Important
Notes
Topic: Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Details: Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.
The purpose of this text-only errata is to inform you about the security issues fixed.
Security Fix(es):
* vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)
* jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision (CVE-2026-10050)
* rhaf-camel-spring-boot-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting (CVE-2026-66274)
* jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections (CVE-2026-10051)
* sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation (CVE-2026-56624)
* cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage (CVE-2026-66909)
* cxf-rt-rs-security-oauth2: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider (CVE-2026-68079)
* cxf-rt-rs-security-oauth2: Apache CXF: Authorization Code Replay via Race Condition (CVE-2026-57818)
* cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation (CVE-2026-57817)
* camel: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (CVE-2026-46457)
* camel: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (CVE-2026-46456)
* camel: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields (CVE-2026-48203)
* camel-amqp: Apache Camel: Information disclosure via deserialization of untrusted data (CVE-2026-42527)
* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation (CVE-2026-66273)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching (CVE-2026-66257)
* netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder (CVE-2026-73507)
* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing (CVE-2026-59296)
* cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters (CVE-2026-63687)
* camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery (CVE-2026-63621)
* camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component (CVE-2026-66908)
* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)
* httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak (CVE-2026-64607)
* jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability (CVE-2026-87825)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service (CVE-2026-87877)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (CVE-2026-87824)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service (CVE-2026-87795)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)
* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress (CVE-2026-90560)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing (CVE-2026-90852)
* netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion (CVE-2026-59902)
* camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior (CVE-2026-59230)
* netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user's password, thereby bypassing authentication and gaining unauthorized access to the victim's account.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Eclipse Vert.x. The `DefaultRedirectHandler` in `vertx-core` improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machine (JVM) can be coerced into performing DNS lookups during the deserialization process. This provides an attacker with an information disclosure side channel, with the highest risk observed in the camel-jms family of components.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected headers can then influence the behavior of downstream producers in the route, potentially leading to unauthorized message manipulation or redirection of data.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route, potentially leading to actions such as redirecting HTTP producers, altering file names, or overriding queries. This vulnerability allows for manipulation of the application's control flow.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes (SolrParam. and SolrField.) that bypass the HTTP header filter. This improper input validation allows for Server-Side Request Forgery (SSRF), enabling the attacker to force the Solr server to make requests to arbitrary URLs, potentially accessing internal services or cloud metadata endpoints. Additionally, attackers can inject arbitrary fields into indexed documents.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the `c_hash` parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider (IdP), to perform Authorization Code Substitution/Injection attacks. Such an attack could lead to unauthorized access or session hijacking.
CWE-303 - Incorrect Implementation of Authentication AlgorithmAffected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Low
A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized access or session hijacking.
4.2 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may inject Camel-internal headers into the Exchange. Downstream Camel components may interpret these headers as control inputs and alter route behavior, potentially causing unintended actions or data processing. The actual impact depends on the downstream route and components that process the message. The vulnerable behavior affects camel-mail versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The default headersInline=false configuration is not affected because MIME headers are handled as attachments rather than copied to the Camel message headers.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty. The `SctpMessageCompletionHandler` component, which handles Stream Control Transmission Protocol (SCTP) messages, limits incomplete messages and fragment counts but does not properly limit `maxBufferedBytes`. An unauthenticated remote attacker could send specially crafted, large SCTP fragments, causing memory exhaustion and a denial-of-service (DoS) condition. The issue is fixed in Netty 4.1.137.Final and 4.2.17.Final.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Camel headers through a specially crafted CloudEvent request. Such injected headers can override configured values when messages are forwarded to other components, leading to server-side request forgery (SSRF), path traversal, or message-dispatch redirection.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like code_challenge and nonce, the attacker can undermine the integrity of Proof Key for Code Exchange (PKCE) and OpenID Connect replay protection, potentially leading to unauthorized access or session hijacking.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token (JWT) authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any unexpired JWT signed by a trusted key, regardless of its intended issuer or audience. Consequently, unauthorized access to resources protected by the embedded HTTP server may occur, potentially leading to a bypass of security controls.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache CXF. The Java Message Service (JMS) transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead to a denial of service or, in certain configurations, enable remote code execution on the affected system.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the `removeCodeGrant` functionality, which fails to properly invalidate used authorization codes. This can lead to unauthorized access or session hijacking, violating the security principle that authorization codes should only be used once.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
References
264 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.\n\nRed Hat Product Security has rated this update as having a security impact of\nImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.\n\nThe purpose of this text-only errata is to inform you about the security issues fixed.\n\nSecurity Fix(es):\n\n* vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)\n\n* jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision (CVE-2026-10050)\n\n* rhaf-camel-spring-boot-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting (CVE-2026-66274)\n\n* jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections (CVE-2026-10051)\n\n* sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation (CVE-2026-56624)\n\n* cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage (CVE-2026-66909)\n\n* cxf-rt-rs-security-oauth2: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider (CVE-2026-68079)\n\n* cxf-rt-rs-security-oauth2: Apache CXF: Authorization Code Replay via Race Condition (CVE-2026-57818)\n\n* cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation (CVE-2026-57817)\n\n* camel: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (CVE-2026-46457)\n\n* camel: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (CVE-2026-46456)\n\n* camel: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields (CVE-2026-48203)\n\n* camel-amqp: Apache Camel: Information disclosure via deserialization of untrusted data (CVE-2026-42527)\n\n* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation (CVE-2026-66273)\n\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching (CVE-2026-66257)\n\n* netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder (CVE-2026-73507)\n\n* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing (CVE-2026-59296)\n\n* cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters (CVE-2026-63687)\n\n* camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery (CVE-2026-63621)\n\n* camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component (CVE-2026-66908)\n\n* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)\n\n* httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak (CVE-2026-64607)\n\n* jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)\n\n* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability (CVE-2026-87825)\n\n* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service (CVE-2026-87877)\n\n* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (CVE-2026-87824)\n\n* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service (CVE-2026-87795)\n\n* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)\n\n* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)\n\n* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress (CVE-2026-90560)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)\n\n* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing (CVE-2026-90852)\n\n* netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion (CVE-2026-59902)\n\n* camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior (CVE-2026-59230)\n\n* netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:71675",
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2497260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497260"
},
{
"category": "external",
"summary": "2497261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497261"
},
{
"category": "external",
"summary": "2497282",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497282"
},
{
"category": "external",
"summary": "2497294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497294"
},
{
"category": "external",
"summary": "2499919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499919"
},
{
"category": "external",
"summary": "2499928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499928"
},
{
"category": "external",
"summary": "2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "2511977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511977"
},
{
"category": "external",
"summary": "2511983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511983"
},
{
"category": "external",
"summary": "2511988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511988"
},
{
"category": "external",
"summary": "2511989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511989"
},
{
"category": "external",
"summary": "2511992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511992"
},
{
"category": "external",
"summary": "2515374",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515374"
},
{
"category": "external",
"summary": "2520949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"
},
{
"category": "external",
"summary": "2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "2531964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
},
{
"category": "external",
"summary": "2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71675.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.",
"tracking": {
"current_release_date": "2026-09-25T21:00:41+00:00",
"generator": {
"date": "2026-09-25T21:00:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:71675",
"initial_release_date": "2026-09-24T19:56:44+00:00",
"revision_history": [
{
"date": "2026-09-24T19:56:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-24T19:56:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-25T21:00:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16",
"product": {
"name": "Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16",
"product_id": "Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.18"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-10050",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty\u0027s hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user\u0027s password, thereby bypassing authentication and gaining unauthorized access to the victim\u0027s account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw allows an authentication bypass in Eclipse Jetty\u0027s HTTP Digest authentication. An attacker who knows a victim\u0027s username can craft a collision password if the original password contains non-Latin-1 characters, leading to unauthorized access in affected Red Hat products that utilize this authentication method.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10050"
},
{
"category": "external",
"summary": "RHBZ#2510732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"
}
],
"release_date": "2026-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that all user passwords configured for HTTP Digest authentication in affected Eclipse Jetty deployments exclusively use characters within the Latin-1 character set. This prevents the character encoding collision that leads to authentication bypass.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision"
},
{
"cve": "CVE-2026-10051",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-14T10:01:09.470495+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499928"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This information disclosure flaw in Eclipse Jetty allows HTTP/1.1 trailers from a previous request to be retained and subsequently exposed to other requests sharing the same connection. This could lead to unintended disclosure of sensitive information in Red Hat products utilizing Jetty, such as Red Hat AMQ and Enterprise Application Platform, particularly when connection reuse is active and trailers contain confidential data. The confidentiality impact is considered low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10051"
},
{
"category": "external",
"summary": "RHBZ#2499928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499928"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10051"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119"
}
],
"release_date": "2026-07-14T08:44:38.233000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections"
},
{
"cve": "CVE-2026-12860",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:01:02.591427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "RHBZ#2510256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
"url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
}
],
"release_date": "2026-08-03T02:55:58.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
},
{
"cve": "CVE-2026-15075",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-07-14T09:01:12.413297+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499919"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Vert.x. The `DefaultRedirectHandler` in `vertx-core` improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Eclipse Vert.x\u0027s `DefaultRedirectHandler` that affects Red Hat products utilizing `vertx-core` for HTTP client operations. The vulnerability allows sensitive request headers, such as authentication tokens and session cookies, to be forwarded to arbitrary external domains during HTTP 30x redirects. This could enable an attacker to capture credentials if they can induce a Vert.x HttpClient to redirect to a malicious server, potentially leading to unauthorized access.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15075"
},
{
"category": "external",
"summary": "RHBZ#2499919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499919"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161"
}
],
"release_date": "2026-07-14T08:15:53.650000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure applications utilizing Vert.x HttpClient to strictly validate and restrict the URLs to which HTTP requests can be redirected. Implement allowlists for trusted domains and ensure that any user-supplied or external URLs processed by Vert.x HttpClient are thoroughly sanitized and validated to prevent redirection to attacker-controlled destinations. This may involve updating application-specific configurations or implementing custom URL validation logic. A service restart or reload may be required for changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects"
},
{
"cve": "CVE-2026-42527",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-06T09:02:24.664617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system\u0027s Java Virtual Machine (JVM) can be coerced into performing DNS lookups during the deserialization process. This provides an attacker with an information disclosure side channel, with the highest risk observed in the camel-jms family of components.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Apache Camel components are susceptible to information disclosure through deserialization of untrusted data. When an attacker provides a specially crafted Java-serialized payload to an affected Camel consumer, the default ObjectInputFilter pattern allows DNS queries to an attacker-controlled host. This vulnerability primarily impacts deployments where camel-jms is used with mapJmsMessage=true (default), enabling an out-of-band side channel for information leakage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42527"
},
{
"category": "external",
"summary": "RHBZ#2497294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42527"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-42527.html",
"url": "https://camel.apache.org/security/CVE-2026-42527.html"
}
],
"release_date": "2026-07-06T07:55:06.159000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure a JVM-wide deserialization filter to explicitly deny `java.net` classes. This can be achieved by setting the system property `-Djdk.serialFilter=\u0027!java.net.**;java.**;javax.**;org.apache.camel.**;!*\u0027` when starting the Java Virtual Machine. For aggregation-repository components, use `\u0027!java.net.**;java.**;org.apache.camel.**;!*\u0027`. This may impact functionality if legitimate deserialization of `java.net` classes is required. A restart of the affected Apache Camel application is required for the changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data"
},
{
"cve": "CVE-2026-46456",
"cwe": {
"id": "CWE-1173",
"name": "Improper Use of Validation Framework"
},
"discovery_date": "2026-07-06T09:01:51.230975+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497282"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected headers can then influence the behavior of downstream producers in the route, potentially leading to unauthorized message manipulation or redirection of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Critical improper input validation vulnerability in the `camel-aws2-sqs` component of Red Hat build of Apache Camel. A remote attacker with `sqs:SendMessage` permissions to a consumed SQS queue can inject arbitrary Camel control headers into the message exchange. This allows for manipulation of downstream producer behavior, potentially leading to data redirection, file modification, or query alteration, without requiring authentication to the Camel application itself.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46456"
},
{
"category": "external",
"summary": "RHBZ#2497282",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497282"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46456"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-46456.html",
"url": "https://camel.apache.org/security/CVE-2026-46456.html"
}
],
"release_date": "2026-07-06T07:56:51.598000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure your Camel routes to strip Camel control headers from inbound messages before they reach any downstream producer. Additionally, restrict who can send messages to the consumed SQS queue by applying least-privilege `sqs:SendMessage` permissions on the queue resource policy. For example, add `removeHeaders(\u0027Camel*\u0027)` and `removeHeaders(\u0027camel*\u0027)` at the start of the route. Ensure that any changes to route configurations are properly deployed and services are reloaded or restarted if necessary for the changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers"
},
{
"cve": "CVE-2026-46457",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-06T09:01:04.765484+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497260"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route, potentially leading to actions such as redirecting HTTP producers, altering file names, or overriding queries. This vulnerability allows for manipulation of the application\u0027s control flow.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the Apache Camel NATS component allows an unauthenticated attacker to inject arbitrary Camel control headers into the message exchange. This is possible when the NATS server lacks authentication, enabling a client to manipulate downstream producer behavior, such as redirecting HTTP requests or altering file operations. The impact is significant due to the potential for unauthorized control over data flow within Camel routes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46457"
},
{
"category": "external",
"summary": "RHBZ#2497260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46457"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46457",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46457"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-46457.html",
"url": "https://camel.apache.org/security/CVE-2026-46457.html"
}
],
"release_date": "2026-07-06T07:57:13.104000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To reduce exposure, configure Apache Camel routes to filter out Camel control headers from incoming NATS messages before they are processed by any downstream producer. Additionally, enable authentication on the NATS server to restrict publishing access to trusted clients only.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers"
},
{
"cve": "CVE-2026-48203",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-07-06T09:01:07.715960+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497261"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes (SolrParam. and SolrField.) that bypass the HTTP header filter. This improper input validation allows for Server-Side Request Forgery (SSRF), enabling the attacker to force the Solr server to make requests to arbitrary URLs, potentially accessing internal services or cloud metadata endpoints. Additionally, attackers can inject arbitrary fields into indexed documents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in the Apache Camel Solr component allows unauthenticated remote attackers to inject arbitrary Solr query parameters and document fields. When an HTTP consumer bridges to a Solr producer in Red Hat build of Apache Camel, the HttpHeaderFilterStrategy fails to block SolrParam.* and SolrField.* headers, enabling server-side request forgery (SSRF) and potential access to internal services or administrative Solr handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48203"
},
{
"category": "external",
"summary": "RHBZ#2497261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48203"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48203",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48203"
},
{
"category": "external",
"summary": "http://camel.apache.org/security/CVE-2026-48203.html",
"url": "http://camel.apache.org/security/CVE-2026-48203.html"
}
],
"release_date": "2026-07-06T08:06:22.592000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To prevent exploitation, configure Apache Camel routes to strip SolrParam.* and SolrField.* headers from untrusted ingress before they reach the solr: producer. Any required Solr parameters and fields should then be set from a trusted source within the route. This operational control limits the injection of malicious Solr query parameters and document fields.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57817",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-08-06T11:10:50.104513+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511977"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the `c_hash` parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider (IdP), to perform Authorization Code Substitution/Injection attacks. Such an attack could lead to unauthorized access or session hijacking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has a Low impact on Red Hat products. Apache CXF, as used in Red Hat Enterprise Application Platform, Red Hat JBoss Web Server, and Red Hat build of Apache Camel, is susceptible to Authorization Code Substitution/Injection attacks when integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash` parameter in the OpenID Connect Hybrid Flow. Exploitation requires a specific misconfiguration of the external IdP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57817"
},
{
"category": "external",
"summary": "RHBZ#2511977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511977"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57817"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pj63c3pf7kkp1xhr53do704fwj3t3htn",
"url": "https://lists.apache.org/thread/pj63c3pf7kkp1xhr53do704fwj3t3htn"
}
],
"release_date": "2026-08-06T10:24:05.877000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation"
},
{
"cve": "CVE-2026-57818",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-08-06T11:51:44.503369+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511992"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized access or session hijacking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57818"
},
{
"category": "external",
"summary": "RHBZ#2511992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57818"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz",
"url": "https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz"
}
],
"release_date": "2026-08-06T11:24:53.590000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-08-03T03:02:32.846217+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510250"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "RHBZ#2510250",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
}
],
"release_date": "2026-08-03T02:41:30.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
},
{
"cve": "CVE-2026-59230",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-08-24T16:21:24.097805+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2522054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel\u0027s camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy.\n\nAn attacker who can provide a crafted MIME message may inject Camel-internal headers into the Exchange. Downstream Camel components may interpret these headers as control inputs and alter route behavior, potentially causing unintended actions or data processing. The actual impact depends on the downstream route and components that process the message.\n\nThe vulnerable behavior affects camel-mail versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The default headersInline=false configuration is not affected because MIME headers are handled as attachments rather than copied to the Camel message headers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59230"
},
{
"category": "external",
"summary": "RHBZ#2522054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59230"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-59230.html",
"url": "https://camel.apache.org/security/CVE-2026-59230.html"
}
],
"release_date": "2026-08-24T16:09:44.229000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Users should upgrade to Apache Camel 4.14.9, 4.18.4, or 4.22.0, as applicable to their release stream.\n\nWhere an upgrade is not immediately possible, keep headersInline=false unless inline MIME headers are required. If headersInline=true must remain enabled, remove Camel-internal headers immediately after the unmarshalling step, before any processor or producer reads Camel control headers. For example, routes may use removeHeaders(\"Camel*\") as a defense-in-depth measure.\n\nDo not unmarshal MIME content from an untrusted sender into a route that dispatches or performs sensitive operations based on message header values. Treat MIME header names received from outside the trust boundary as untrusted input.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.camel/camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior"
},
{
"cve": "CVE-2026-59296",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-08-21T10:50:55.231408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer\u0027s StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59296"
},
{
"category": "external",
"summary": "RHBZ#2520949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-59296",
"url": "https://spring.io/security/cve-2026-59296"
}
],
"release_date": "2026-08-21T10:47:25.384000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing"
},
{
"cve": "CVE-2026-59902",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-17T18:01:54.592668+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517526"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The `SctpMessageCompletionHandler` component, which handles Stream Control Transmission Protocol (SCTP) messages, limits incomplete messages and fragment counts but does not properly limit `maxBufferedBytes`. An unauthenticated remote attacker could send specially crafted, large SCTP fragments, causing memory exhaustion and a denial-of-service (DoS) condition. The issue is fixed in Netty 4.1.137.Final and 4.2.17.Final.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59902"
},
{
"category": "external",
"summary": "RHBZ#2517526",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517526"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59902"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59902",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59902"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f",
"url": "https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f"
}
],
"release_date": "2026-08-17T17:48:55.663000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion"
},
{
"cve": "CVE-2026-62243",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-22T12:51:41.376413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "RHBZ#2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
"url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
}
],
"release_date": "2026-08-22T12:26:43.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
},
{
"cve": "CVE-2026-63621",
"cwe": {
"id": "CWE-791",
"name": "Incomplete Filtering of Special Elements"
},
"discovery_date": "2026-08-24T16:40:56.160707+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2522066"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Camel headers through a specially crafted CloudEvent request. Such injected headers can override configured values when messages are forwarded to other components, leading to server-side request forgery (SSRF), path traversal, or message-dispatch redirection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Apache Camel Knative that allows an unauthenticated, remote attacker to perform server-side request forgery, path traversal, or message-dispatch redirection. The flaw occurs because the Knative consumer in camel-knative improperly processes CloudEvent extension fields in structured content mode, allowing the injection of internal Camel headers. This can lead to an attacker controlling internal routing or file access within affected Red Hat OpenShift Serverless and Red Hat build of Apache Camel deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63621"
},
{
"category": "external",
"summary": "RHBZ#2522066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522066"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63621"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63621",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63621"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-63621.html",
"url": "https://camel.apache.org/security/CVE-2026-63621.html"
}
],
"release_date": "2026-08-24T16:17:26.499000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery"
},
{
"cve": "CVE-2026-63687",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-08-06T11:51:29.090614+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511988"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client\u0027s secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like code_challenge and nonce, the attacker can undermine the integrity of Proof Key for Code Exchange (PKCE) and OpenID Connect replay protection, potentially leading to unauthorized access or session hijacking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache CXF\u0027s JwtRequestCodeFilter allows a security bypass in authorization flows. An attacker with a compromised client secret can manipulate critical authorization parameters, including code_challenge and nonce, to undermine PKCE integrity and OpenID Connect replay protection. This could lead to unauthorized access or session hijacking in applications utilizing affected Red Hat middleware products that rely on these security mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63687"
},
{
"category": "external",
"summary": "RHBZ#2511988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63687"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63687",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63687"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw",
"url": "https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw"
}
],
"release_date": "2026-08-06T11:23:45.175000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-66257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:13.741100+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache Qpid Proton-J, allowing a pre-authentication attacker to exhaust system resources through unbounded symbol value caching. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability\u0027s impact is significant due to the potential for unauthenticated remote attackers to disrupt service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66257"
},
{
"category": "external",
"summary": "RHBZ#2511326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm",
"url": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm"
}
],
"release_date": "2026-08-05T05:18:01.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching"
},
{
"cve": "CVE-2026-66273",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T06:01:00.913036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Qpid Proton-J allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66273"
},
{
"category": "external",
"summary": "RHBZ#2511322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh",
"url": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh"
}
],
"release_date": "2026-08-05T05:23:31.964000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation"
},
{
"cve": "CVE-2026-66274",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-05T07:00:53.637061+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66274"
},
{
"category": "external",
"summary": "RHBZ#2511337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h",
"url": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h"
}
],
"release_date": "2026-08-05T05:29:44.681000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting"
},
{
"cve": "CVE-2026-66908",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-08-24T16:21:46.362822+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2522058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token (JWT) authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the \u0027iss\u0027 and \u0027aud\u0027 claims. This improper authentication allows an attacker to use any unexpired JWT signed by a trusted key, regardless of its intended issuer or audience. Consequently, unauthorized access to resources protected by the embedded HTTP server may occur, potentially leading to a bypass of security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss Fuse 7 is not affected because it includes Camel 2.x, and the vulnerable code was introduced in Apache Camel 4.8.0. \n\nOpenShift Serverless Knative eventing integration images and Red Hat build of Apache Camel for Quarkus are not affected because they do not include camel-platform-http-main and rely on Quarkus / Vert.x HTTP stacks instead. \n\nRed Hat build of Apache Camel for Spring Boot is affected; a fix is available via RHSA-2026:71675. On the 4.18 line, configure jwtIssuer and/or jwtAudience (or review the documented JWT authentication options) so issuer and audience claims are enforced.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66908"
},
{
"category": "external",
"summary": "RHBZ#2522058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66908"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66908",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66908"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-66908.html",
"url": "https://camel.apache.org/security/CVE-2026-66908.html"
}
],
"release_date": "2026-08-24T16:14:18.202000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component"
},
{
"cve": "CVE-2026-66909",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-06T11:11:08.945917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511983"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF. The Java Message Service (JMS) transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service\u0027s JMS destination. This vulnerability could lead to a denial of service or, in certain configurations, enable remote code execution on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.cxf/cxf: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Apache CXF\u0027s JMS transport is rated as Important because it allows for remote code execution or denial of service if an attacker can send a specially crafted JMS ObjectMessage to a service. This is particularly relevant in Red Hat environments where Apache CXF is used in applications that process JMS messages, as the default deserialization behavior without type restrictions increases the attack surface. Exploitation requires the presence of a suitable gadget class on the classpath.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66909"
},
{
"category": "external",
"summary": "RHBZ#2511983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511983"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66909"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66909",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66909"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpx",
"url": "https://lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpx"
}
],
"release_date": "2026-08-06T10:23:23.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, disable ObjectMessage deserialization in Apache CXF\u0027s JMS transport. This can typically be achieved through a configuration setting provided by the Apache CXF framework. Consult the Apache CXF documentation for specific instructions on how to disable ObjectMessage deserialization in your deployment. Disabling this feature may impact applications that rely on ObjectMessage for legitimate data transfer.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.cxf/cxf: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage"
},
{
"cve": "CVE-2026-68079",
"cwe": {
"id": "CWE-613",
"name": "Insufficient Session Expiration"
},
"discovery_date": "2026-08-06T11:51:32.402484+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache CXF\u0027s DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the `removeCodeGrant` functionality, which fails to properly invalidate used authorization codes. This can lead to unauthorized access or session hijacking, violating the security principle that authorization codes should only be used once.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68079"
},
{
"category": "external",
"summary": "RHBZ#2511989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68079"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o",
"url": "https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o"
}
],
"release_date": "2026-08-06T11:22:57.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-68497",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-09-11T16:01:15.919616+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in jackson-databind allows remote attackers to consume excessive CPU by submitting specially crafted JSON with unbounded numeric values, causing a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68497"
},
{
"category": "external",
"summary": "RHBZ#2531964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd",
"url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/6127",
"url": "https://github.com/FasterXML/jackson-databind/pull/6127"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
}
],
"release_date": "2026-09-11T15:49:30.366000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing"
},
{
"cve": "CVE-2026-73507",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-08-13T15:11:27.106908+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515374"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Netty\u0027s XmlFrameDecoder component within the netty-codec-xml library. Red Hat products including JBoss EAP 7, Red Hat Fuse 7, Red Hat Single Sign-On 7, and Red Hat Integration Camel Spring Boot ship the netty-codec-xml library. However, these products do not utilize the XmlFrameDecoder class for XML processing. The vulnerable code path, which handles reassembly of fragmented XML messages across network frames, is not instantiated or exercised in Red Hat product deployments. This vulnerability only affects custom applications that explicitly use XmlFrameDecoder to parse untrusted XML input from network streams.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73507"
},
{
"category": "external",
"summary": "RHBZ#2515374",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515374"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73507"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73507",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73507"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-v74w-7mr3-4qg3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-v74w-7mr3-4qg3"
}
],
"release_date": "2026-08-13T14:25:34.073000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Red Hat products do not use the vulnerable XmlFrameDecoder component. No mitigation is required for standard product deployments. Custom applications built on Red Hat middleware that explicitly instantiate XmlFrameDecoder should avoid processing untrusted XML input or upgrade to netty-codec-xml 4.1.136.Final or later.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder"
},
{
"cve": "CVE-2026-75595",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-08-19T21:20:58.535091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that allows an unauthenticated remote attacker to bypass mutual TLS authentication. Applications that use Netty and rely solely on SNI-based clientAuth=REQUIRE for access control, without additional application-layer certificate verification, are vulnerable when an attacker exploits fragmented TLS ClientHello messages to force a fallback to a less secure default SslContext. Deployments that enforce clientAuth=REQUIRE uniformly across all SslContexts, or that perform secondary certificate verification at the application layer, are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75595"
},
{
"category": "external",
"summary": "RHBZ#2519953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961",
"url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"
}
],
"release_date": "2026-08-19T21:00:27.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"
},
{
"cve": "CVE-2026-87795",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T10:21:04.988917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni caused by insufficient validation of offset and length values in the ZstdDictCompress constructor. An attacker who can influence these values may cause a JVM crash and potentially disclose native heap data. Affected Red Hat products are tracked through their existing remediation workflow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87795"
},
{
"category": "external",
"summary": "RHBZ#2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"release_date": "2026-09-09T10:07:28.656000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service"
},
{
"cve": "CVE-2026-87824",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T14:51:05.674319+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87824 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow a remote attacker to terminate the Java Virtual Machine by supplying crafted sample lengths to the dictionary-training function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "RHBZ#2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980",
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"release_date": "2026-09-09T14:32:44.099000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect"
},
{
"cve": "CVE-2026-87825",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T14:52:13.405564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary\u0027s shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in zstd-jni that could lead to silent data corruption or JVM crashes due to a use-after-free vulnerability. The flaw arises when a dictionary is prematurely closed while still actively referenced by compression or decompression streams, potentially impacting Red Hat products that utilize zstd-jni for data handling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "RHBZ#2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"release_date": "2026-09-09T14:32:44.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability"
},
{
"cve": "CVE-2026-87877",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-09T14:51:43.444501+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87877 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow memory corruption or denial of service when specific stream methods are called after the stream has been closed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "RHBZ#2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"release_date": "2026-09-09T14:32:45.512000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service"
},
{
"cve": "CVE-2026-89046",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-10T17:51:53.452234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni when a negative source position is supplied to Zstd.getFrameContentSize. This may disclose native memory or cause a JVM crash. Affected Red Hat products are tracked for updates containing zstd-jni 1.5.7-14 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89046"
},
{
"category": "external",
"summary": "RHBZ#2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"release_date": "2026-09-10T17:39:35.519000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read"
},
{
"cve": "CVE-2026-90560",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-12T18:10:57.851894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532604"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that affected versions of zstd-jni are vulnerable to an out-of-bounds read in the ZstdDictDecompress constructor. An attacker who can cause an application to supply invalid dictionary offset or length values may terminate the Java Virtual Machine, resulting in denial of service. Red Hat is tracking fixes for affected products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90560"
},
{
"category": "external",
"summary": "RHBZ#2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37",
"url": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f",
"url": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/405",
"url": "https://github.com/luben/zstd-jni/issues/405"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress"
}
],
"release_date": "2026-09-12T18:06:43.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress"
},
{
"cve": "CVE-2026-90852",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-15T02:41:02.899732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote use-after-free vulnerability in the `zstd-jni` library\u0027s dictionary sharing functionality. The flaw, affecting the `ZstdCompressCtx.loadDict` function, could allow an unauthenticated attacker to trigger a crash or potentially execute arbitrary code due to public exploit disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "RHBZ#2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/",
"url": "https://github.com/luben/zstd-jni/"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/404",
"url": "https://github.com/luben/zstd-jni/issues/404"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-90852",
"url": "https://vuldb.com/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/927022",
"url": "https://vuldb.com/submit/927022"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407",
"url": "https://vuldb.com/vuln/403407"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407/cti",
"url": "https://vuldb.com/vuln/403407/cti"
}
],
"release_date": "2026-09-15T02:15:10.581000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T19:56:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:71675"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…