RHSA-2026:54622
Vulnerability from csaf_redhat - Published: 2026-08-13 14:50 - Updated: 2026-08-14 01:22Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
Severity
Important
Notes
Topic: Red Hat build of Apache Camel 4.18.3 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Details: Red Hat build of Apache Camel 4.18.3 for Spring Boot patch release and security update is now available.
The purpose of this text-only errata is to inform you about the security issues fixed.
Security Fix(es):
* vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)
* c3p0: c3p0: Remote code execution via deserialization vulnerability (CVE-2026-55223)
* mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection (CVE-2026-55153)
* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
* httpcore: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)
* camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection (CVE-2026-43866)
* camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure (CVE-2026-46726)
* camel-cxf-common: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation (CVE-2026-46592)
* camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers (CVE-2026-46584)
* camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data (CVE-2026-40859)
* httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428)
* httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)
* commons-configuration2: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input (CVE-2026-45205)
* netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder (CVE-2026-44891)
* vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076)
* netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
* netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
* netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)
* netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)
* netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)
* netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability (CVE-2026-56817)
* netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)
* netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack (CVE-2026-56820)
* netty-codec-http: Netty: Memory exhaustion in netty-codec-http (CVE-2026-59899)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in eclipse-vertx/vert.x. A remote attacker can exploit this vulnerability by performing a Transport Layer Security (TLS) handshake and presenting a server name extension with a server wildcard name. This can lead to a denial of service (DoS) condition, impacting the availability of the affected system.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party domain. When the victim application subsequently sends a request to the targeted domain, the injected cookie is presented, potentially leading to information disclosure and unauthorized access to sensitive data through the attacker's account on that service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `camel-vertx-http` component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted serialized Java object. If the producer endpoint is configured to transfer exceptions, this could lead to remote code execution on the affected Camel application.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject arbitrary Exchange state. This injection can lead to the manipulation of routing, headers, exchange properties, and error handling within the application.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. The decoder fails to properly limit the total number or cumulative size of headers per frame, leading to excessive memory consumption and ultimately crashing the server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of SMTP connections to an attacker-controlled server, exposing user credentials. In later versions, the impact is limited to weakening transport security and intercepting outgoing messages, potentially leading to information disclosure.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the `operationName` header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the `CxfProducer` to invoke unintended SOAP operations on the backend service. This could lead to a 'confused deputy' scenario, where a read operation is replaced with a destructive one, impacting the integrity of the backend service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery (SSRF), where the server is coerced into making requests to arbitrary internal or external destinations. Additionally, the flaw can result in the disclosure of sensitive information, including environment variables, application properties, and vault secrets.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in mchange-commons-java, a Java utility library. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface (JNDI) injection. The library's JNDI ObjectFactory can construct objects of arbitrary classes and initialize properties, which can be exploited by malicious JNDI Reference objects. This could lead to an attacker executing unauthorized code within the application's security domain.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger vulnerable JDBC drivers. This requires specific conditions, including the presence of a susceptible JDBC driver and a mechanism for automatic property resolution during deserialization.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote attacker could exploit this vulnerability by sending specially crafted XML data containing a DOCTYPE declaration to a vulnerable XmlDecoder within the Netty channel pipeline. This can lead to an XML External Entity (XXE) vulnerability, potentially allowing the attacker to disclose sensitive information from the system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. The `OcspClient` component fails to validate that the Certificate ID in an Online Certificate Status Protocol (OCSP) response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimately signed OCSP response for an unrelated certificate issued by the same Certificate Authority, leading to a replay attack. This can result in the acceptance of revoked certificates, potentially compromising the integrity and confidentiality of communications.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
176 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of Apache Camel 4.18.3 for Spring Boot patch release and security update is now available.\n\nRed Hat Product Security has rated this update as having a security impact of\nImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Apache Camel 4.18.3 for Spring Boot patch release and security update is now available.\n\nThe purpose of this text-only errata is to inform you about the security issues fixed.\n\nSecurity Fix(es):\n\n* vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)\n\n* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)\n\n* jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)\n\n* c3p0: c3p0: Remote code execution via deserialization vulnerability (CVE-2026-55223)\n\n* mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection (CVE-2026-55153)\n\n* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)\n\n* httpcore: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)\n\n* camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection (CVE-2026-43866)\n\n* camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure (CVE-2026-46726)\n\n* camel-cxf-common: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation (CVE-2026-46592)\n\n* camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers (CVE-2026-46584)\n\n* camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data (CVE-2026-40859)\n\n* httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428)\n\n* httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)\n\n* commons-configuration2: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input (CVE-2026-45205)\n\n* netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder (CVE-2026-44891)\n\n* vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076)\n\n* netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)\n\n* netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)\n\n* netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)\n\n* netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)\n\n* netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)\n\n* netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability (CVE-2026-56817)\n\n* netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)\n\n* netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack (CVE-2026-56820)\n\n* netty-codec-http: Netty: Memory exhaustion in netty-codec-http (CVE-2026-59899)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54622",
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2466990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466990"
},
{
"category": "external",
"summary": "2477425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477425"
},
{
"category": "external",
"summary": "2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "2492010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
},
{
"category": "external",
"summary": "2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "2495798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495798"
},
{
"category": "external",
"summary": "2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "2496197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496197"
},
{
"category": "external",
"summary": "2497283",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497283"
},
{
"category": "external",
"summary": "2497287",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497287"
},
{
"category": "external",
"summary": "2497288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497288"
},
{
"category": "external",
"summary": "2497295",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497295"
},
{
"category": "external",
"summary": "2497297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497297"
},
{
"category": "external",
"summary": "2499914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499914"
},
{
"category": "external",
"summary": "2501958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501958"
},
{
"category": "external",
"summary": "2503101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
},
{
"category": "external",
"summary": "2503103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
},
{
"category": "external",
"summary": "2505422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
},
{
"category": "external",
"summary": "2505698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
},
{
"category": "external",
"summary": "2505911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
},
{
"category": "external",
"summary": "2505975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505975"
},
{
"category": "external",
"summary": "2505980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
},
{
"category": "external",
"summary": "2505982",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505982"
},
{
"category": "external",
"summary": "2507482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54622.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.",
"tracking": {
"current_release_date": "2026-08-14T01:22:50+00:00",
"generator": {
"date": "2026-08-14T01:22:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:54622",
"initial_release_date": "2026-08-13T14:50:50+00:00",
"revision_history": [
{
"date": "2026-08-13T14:50:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-13T14:50:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-14T01:22:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16",
"product": {
"name": "Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16",
"product_id": "Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.18"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-6860",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-06T10:01:43.929832+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466990"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in eclipse-vertx/vert.x. A remote attacker can exploit this vulnerability by performing a Transport Layer Security (TLS) handshake and presenting a server name extension with a server wildcard name. This can lead to a denial of service (DoS) condition, impacting the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Moderate because a remote attacker can trigger a denial of service in Red Hat products that use `eclipse-vertx/vert.x` and are configured with TLS wildcard server names. Exploitation occurs during the TLS handshake, impacting service availability without affecting data confidentiality or integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6860"
},
{
"category": "external",
"summary": "RHBZ#2466990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466990"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6860"
},
{
"category": "external",
"summary": "https://github.com/eclipse-vertx/vert.x/pull/6102",
"url": "https://github.com/eclipse-vertx/vert.x/pull/6102"
},
{
"category": "external",
"summary": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6",
"url": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381"
}
],
"release_date": "2026-05-06T09:55:12.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name"
},
{
"cve": "CVE-2026-15076",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-07-14T09:00:58.070373+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499914"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server\u0027s domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party domain. When the victim application subsequently sends a request to the targeted domain, the injected cookie is presented, potentially leading to information disclosure and unauthorized access to sensitive data through the attacker\u0027s account on that service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Eclipse Vert.x Web Client\u0027s `WebClientSession` component. The vulnerability arises from insufficient validation of the `Domain` attribute in `Set-Cookie` response headers, allowing a remote attacker to inject cookies scoped to arbitrary third-party domains. This could lead to sensitive data exposure and unauthorized access if a victim application subsequently sends requests to the targeted domain, presenting the attacker-controlled cookie. The impact is significant as it bypasses expected cross-domain security boundaries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15076"
},
{
"category": "external",
"summary": "RHBZ#2499914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499914"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162"
}
],
"release_date": "2026-07-14T08:09:12.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation"
},
{
"cve": "CVE-2026-40859",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-06T09:01:53.906971+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497283"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `camel-vertx-http` component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted serialized Java object. If the producer endpoint is configured to transfer exceptions, this could lead to remote code execution on the affected Camel application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because it allows for remote code execution in Apache Camel applications using the `camel-vertx-http` component. Exploitation requires a non-default configuration where `transferException=true` or `allowJavaSerializedObject=true` is enabled on the producer endpoint, in addition to an attacker controlling the backend service or performing a man-in-the-middle attack on an unencrypted connection.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40859"
},
{
"category": "external",
"summary": "RHBZ#2497283",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497283"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40859"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40859",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40859"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40859.html",
"url": "https://camel.apache.org/security/CVE-2026-40859.html"
}
],
"release_date": "2026-07-06T07:54:29.981000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid enabling `transferException=true` or `allowJavaSerializedObject=true` on Apache Camel `camel-vertx-http` producer endpoints that communicate with untrusted or network-reachable backend services. Ensure all producer connections utilize TLS (HTTPS) to prevent man-in-the-middle attacks. If enabling these options is necessary, configure a strict deserialization filter using the `-Djdk.serialFilter` JVM system property, for example: `-Djdk.serialFilter=\"java.**;org.apache.camel.**;!*\"`. This will restrict the classes allowed during deserialization, limiting the potential impact.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data"
},
{
"cve": "CVE-2026-43866",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-06T09:02:32.729522+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497297"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject arbitrary Exchange state. This injection can lead to the manipulation of routing, headers, exchange properties, and error handling within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Apache Camel JMS components. The JmsBinding.extractBodyFromJms() method deserializes incoming JMS ObjectMessage payloads when the mapJmsMessage option is enabled (the default). The prior fix for CVE-2026-40860 can be bypassed using a crafted ObjectMessage containing a DefaultExchangeHolder, which resides within the allowed org.apache.camel namespace. Once deserialized, it injects arbitrary Exchange state including message body, headers, and properties without requiring any deserialization gadget chain. Red Hat builds of Apache Camel for Spring Boot and Quarkus ship the affected camel-jms and camel-amqp components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43866"
},
{
"category": "external",
"summary": "RHBZ#2497297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43866"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43866",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43866"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-43866.html",
"url": "https://camel.apache.org/security/CVE-2026-43866.html"
}
],
"release_date": "2026-07-06T08:35:04.935000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Restrict publish access to JMS queues and topics consumed by Camel applications via broker authorization. Note that a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes within the org.apache.camel namespace.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection"
},
{
"cve": "CVE-2026-44891",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-17T21:03:04.480979+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501958"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. The decoder fails to properly limit the total number or cumulative size of headers per frame, leading to excessive memory consumption and ultimately crashing the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s StompSubframeDecoder component. A remote, unauthenticated attacker can exploit this flaw by sending a large number of small headers to a server exposing a STOMP endpoint. This can lead to excessive memory consumption, causing an OutOfMemoryError and resulting in a complete denial of service for the affected application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44891"
},
{
"category": "external",
"summary": "RHBZ#2501958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501958"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44891"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44891",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44891"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17063",
"url": "https://github.com/netty/netty/pull/17063"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17065",
"url": "https://github.com/netty/netty/pull/17065"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp",
"url": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"
}
],
"release_date": "2026-07-17T20:16:24.486000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To reduce the risk of this denial of service, restrict network access to any services that expose a STOMP endpoint and use Netty\u0027s `StompSubframeDecoder`. Implement firewall rules or network access controls to permit connections only from trusted sources. This action limits the ability of untrusted remote clients to exploit the vulnerability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder"
},
{
"cve": "CVE-2026-45205",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-14T12:00:57.045981+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache Commons Configuration allows a remote attacker to trigger a denial of service by providing specially crafted YAML input containing cycles. This can lead to an uncontrolled recursion and a StackOverflowError, impacting the availability of systems that process untrusted YAML configuration files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45205"
},
{
"category": "external",
"summary": "RHBZ#2477425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45205"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205"
},
{
"category": "external",
"summary": "https://github.com/apache/commons-configuration/pull/634",
"url": "https://github.com/apache/commons-configuration/pull/634"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk",
"url": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk"
}
],
"release_date": "2026-05-14T11:22:43.908000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Apache Commons Configuration to process only trusted YAML configuration files. Implement strict input validation for any YAML content originating from untrusted sources to prevent the parsing of malformed input with cyclical references. This operational control reduces the exposure to denial of service attacks.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input"
},
{
"cve": "CVE-2026-46584",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-07-06T09:02:08.266062+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497288"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of SMTP connections to an attacker-controlled server, exposing user credentials. In later versions, the impact is limited to weakening transport security and intercepting outgoing messages, potentially leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in the Apache Camel Mail Component arises from improper input validation, allowing remote attackers to exploit routes that channel untrusted input into the mail producer without explicit header stripping. Depending on the Apache Camel version, this could lead to credential exposure by redirecting SMTP connections to an attacker-controlled server or, in newer versions, to the weakening of transport security and interception of outgoing messages. Exploitation is contingent on the application\u0027s routing configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46584"
},
{
"category": "external",
"summary": "RHBZ#2497288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497288"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46584"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-46584.html",
"url": "https://camel.apache.org/security/CVE-2026-46584.html"
}
],
"release_date": "2026-07-06T08:02:37.913000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that any Camel routes processing untrusted input and forwarding it to the mail producer explicitly strip the `mail.smtp.*` and `mail.smtps.*` header namespaces. This can be achieved by adding `removeHeaders(\u0027mail.smtp.*\u0027)` and `removeHeaders(\u0027mail.smtps.*\u0027)` to the route definition between the untrusted ingress and the SMTP/SMTPS producer.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers"
},
{
"cve": "CVE-2026-46592",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-07-06T09:02:27.315040+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497295"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the `operationName` header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the `CxfProducer` to invoke unintended SOAP operations on the backend service. This could lead to a \u0027confused deputy\u0027 scenario, where a read operation is replaced with a destructive one, impacting the integrity of the backend service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Apache Camel CXF SOAP component, allowing a remote, unauthenticated attacker to manipulate SOAP operation names via HTTP headers. When an HTTP consumer bridges into a `cxf:` producer, an attacker can force the backend service to execute unintended operations, potentially replacing read operations with destructive ones. This \u0027confused deputy\u0027 scenario impacts the integrity of services utilizing affected Red Hat build of Apache Camel and Enterprise Application Platform configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46592"
},
{
"category": "external",
"summary": "RHBZ#2497295",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497295"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46592"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46592",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46592"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-46592.html",
"url": "https://camel.apache.org/security/CVE-2026-46592.html"
}
],
"release_date": "2026-07-06T08:04:32.968000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the `operationName` and `operationNamespace` headers are not sourced from untrusted input when bridging an HTTP consumer to a `cxf:` producer in Apache Camel routes. Configure the route to explicitly strip these headers from any untrusted ingress before they reach the `cxf:` producer. Subsequently, set the intended SOAP operation from a trusted, internal source within the route. This prevents a remote attacker from manipulating backend service operations. Changes to route configurations may require a service restart to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation"
},
{
"cve": "CVE-2026-46726",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-07-06T09:02:05.657040+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497287"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery (SSRF), where the server is coerced into making requests to arbitrary internal or external destinations. Additionally, the flaw can result in the disclosure of sensitive information, including environment variables, application properties, and vault secrets.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Apache Camel Vertx-WebSocket component. The WebSocket consumer copies inbound query and path parameters into the Camel Exchange header map without applying a HeaderFilterStrategy. An attacker can inject Camel-internal control headers (such as CamelHttpUri) via WebSocket query parameters, causing SSRF when routed to an HTTP producer. The HTTP producer also resolves Camel property placeholders on the attacker-controlled URI, leaking environment variables, application properties, and vault secrets. Red Hat builds of Apache Camel for Spring Boot and Quarkus ship the affected camel-vertx-websocket component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46726"
},
{
"category": "external",
"summary": "RHBZ#2497287",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497287"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46726"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-46726.html",
"url": "https://camel.apache.org/security/CVE-2026-46726.html"
}
],
"release_date": "2026-07-06T08:05:40.270000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Restrict access to exposed WebSocket endpoints with authentication. If unable to upgrade, strip Camel-internal headers from inbound WebSocket messages before they reach downstream producers (for example removeHeaders(\u0027Camel*\u0027) and removeHeaders(\u0027camel*\u0027) at the start of the route).",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-54513",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-06-23T22:01:34.437620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492010"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54513"
},
{
"category": "external",
"summary": "RHBZ#2492010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
"url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
"url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
"url": "https://github.com/FasterXML/jackson-databind/issues/5981"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
"url": "https://github.com/FasterXML/jackson-databind/issues/5983"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
"url": "https://github.com/FasterXML/jackson-databind/pull/5984"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
}
],
"release_date": "2026-06-23T20:53:52.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
},
{
"cve": "CVE-2026-55153",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-01T21:02:25.300003+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496197"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mchange-commons-java, a Java utility library. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface (JNDI) injection. The library\u0027s JNDI ObjectFactory can construct objects of arbitrary classes and initialize properties, which can be exploited by malicious JNDI Reference objects. This could lead to an attacker executing unauthorized code within the application\u0027s security domain.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.mchange/mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in mchange-commons-java, a Java utility library primarily used as a dependency of the c3p0 JDBC connection pool. Prior to version 0.6.0, the library\u0027s JNDI ObjectFactory implementation (JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize JavaBean-style properties, which for certain classes enables JNDI injection and deserialization gadgets. The problem is aggravated by the library\u0027s ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled wherever an application reads a Java-serialized object.\n\nExploitation requires either: (1) an attacker-controllable JNDI lookup name reaching a naming context where the vulnerable ObjectFactory is registered, or (2) a deserialization entry point accepting untrusted Java objects, where ReferenceIndirector serves as a gadget class (similar to Log4Shell-style JNDI injection). All affected Red Hat products ship vulnerable versions (\u003c 0.6.0) of mchange-commons-java as a transitive runtime dependency of c3p0 and Hibernate connection pooling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55153"
},
{
"category": "external",
"summary": "RHBZ#2496197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55153"
},
{
"category": "external",
"summary": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v",
"url": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-h84g-69h7-mw6v"
}
],
"release_date": "2026-07-01T20:02:47.254000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Upgrading to mchange-commons-java \u003e= 0.6.0 is strongly recommended. Most applications that include mchange-commons-java do so to support the c3p0 JDBC connection pooling library. When upgrading mchange-commons-java, be sure to update c3p0 as well \u2014 upgrading to c3p0 \u003e= 0.14.0 will bring in a patched mchange-commons-java transitively.\n\nAs a general hardening measure, applications should avoid deserializing untrusted Java objects, and restrict JNDI lookups to trusted naming contexts only.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.mchange/mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection"
},
{
"cve": "CVE-2026-55223",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-01T00:17:48.138580+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger vulnerable JDBC drivers. This requires specific conditions, including the presence of a susceptible JDBC driver and a mechanism for automatic property resolution during deserialization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "c3p0: c3p0: Remote code execution via deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in c3p0. Prior to version 0.14.0, c3p0\u0027s DataSource and ConnectionPoolDataSource implementations expose getConnection() and getPooledConnection() as JavaBean properties. During deserialization, carrier libraries such as Apache Commons BeanUtils automatically invoke these getters, which can trigger calls into JDBC drivers. An attacker who can deliver a crafted serialized object to an application could exploit this to achieve remote code execution.\n\nSuccessful exploitation requires all of the following prerequisites to be met:\n1. c3p0 \u003c 0.14.0 on the application classpath\n2. A vulnerable JDBC driver on the classpath\n3. A carrier library that auto-reads JavaBean properties during deserialization (e.g., commons-beanutils with a Comparator in a sorted collection)\n4. A deserialization entry point that processes attacker-controlled data (e.g., via RMI, JMX, or HTTP)\n\nThis is a gadget chain attack where c3p0 provides one essential component. Removing any single prerequisite from the classpath prevents exploitation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55223"
},
{
"category": "external",
"summary": "RHBZ#2495798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55223"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27",
"url": "https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58",
"url": "https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58"
}
],
"release_date": "2026-06-30T22:56:55.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Any of the following can reduce the risk or render exploitation not-feasible:\n- Run applications on Java 16 or later, which restricts reflective access and partially blocks the JavaBean property lookup step of the attack chain.\n- Remove Apache Commons BeanUtils from the classpath if it is not required, eliminating the most common deserialization carrier.\n- Ensure the application does not deserialize untrusted input from network sources.\n\nRed Hat recommends updating c3p0 to version 0.14.0 or later when a fix is available, which adds explicit BeanInfo classes to exclude the dangerous properties from JavaBean introspection.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "c3p0: c3p0: Remote code execution via deserialization vulnerability"
},
{
"cve": "CVE-2026-55831",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-21T00:02:57.305291+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503103"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SPDY SETTINGS decoder, allowing a remote unauthenticated attacker to exhaust system resources. By sending a specially crafted SPDY/3.1 SETTINGS frame, an attacker can cause excessive memory allocation and CPU usage, leading to a denial of service. This vulnerability has a low attack complexity and requires no user interaction or privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55831"
},
{
"category": "external",
"summary": "RHBZ#2503103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
}
],
"release_date": "2026-07-20T23:00:31.859000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing"
},
{
"cve": "CVE-2026-55833",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-21T00:01:25.203265+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY header decoding. A remote, unauthenticated attacker can send a small, compressed SPDY header block that, during decompression, expands significantly beyond configured limits. This leads to excessive CPU and memory consumption, potentially causing resource exhaustion and service unavailability in affected Red Hat products that utilize Netty with SPDY.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55833"
},
{
"category": "external",
"summary": "RHBZ#2503101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
}
],
"release_date": "2026-07-20T23:18:07.893000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification"
},
{
"cve": "CVE-2026-55851",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-21T22:43:00.311516+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505698"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55851"
},
{
"category": "external",
"summary": "RHBZ#2505698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55851"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
}
],
"release_date": "2026-07-21T21:22:34.879000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message"
},
{
"cve": "CVE-2026-56745",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-21T22:52:47.296001+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505911"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty\u0027s SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. A remote, unauthenticated attacker can exploit a memory leak in the `SpdyHttpDecoder` by sending specially crafted `SYN_STREAM` frames, leading to native memory exhaustion and a denial of service for the affected system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56745"
},
{
"category": "external",
"summary": "RHBZ#2505911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq",
"url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
}
],
"release_date": "2026-07-21T21:31:25.307000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec"
},
{
"cve": "CVE-2026-56746",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-21T22:30:30.983812+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505422"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat ships Netty\u0027s netty-codec-http component in multiple products. The CorsHandler shortCircuit() feature, when enabled, is intended to reject unauthorized cross-origin requests before they reach the application. Due to a logical operator error in origin validation, requests with a null Origin header bypass this protection entirely. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56746"
},
{
"category": "external",
"summary": "RHBZ#2505422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
}
],
"release_date": "2026-07-21T21:36:18.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header"
},
{
"cve": "CVE-2026-56817",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2026-07-21T23:03:06.114927+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505975"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit this vulnerability by sending specially crafted XML data containing a DOCTYPE declaration to a vulnerable XmlDecoder within the Netty channel pipeline. This can lead to an XML External Entity (XXE) vulnerability, potentially allowing the attacker to disclose sensitive information from the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty\u0027s `XmlDecoder` component allows for XML External Entity (XXE) injection. When a Netty channel pipeline processes XML data with a `DOCTYPE` declaration via an `AsyncXMLInputFactory` that lacks proper security configuration, a remote attacker could potentially disclose sensitive information. The exploitability is conditional, relying on the specific behavior of the Aalto XML async parser.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56817"
},
{
"category": "external",
"summary": "RHBZ#2505975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505975"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56817"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx",
"url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
}
],
"release_date": "2026-07-21T22:06:56.481000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability"
},
{
"cve": "CVE-2026-56819",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"discovery_date": "2026-07-21T23:03:36.448652+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56819"
},
{
"category": "external",
"summary": "RHBZ#2505980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972",
"url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
}
],
"release_date": "2026-07-21T22:11:17.470000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak"
},
{
"cve": "CVE-2026-56820",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-07-21T23:03:50.732777+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2505982"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The `OcspClient` component fails to validate that the Certificate ID in an Online Certificate Status Protocol (OCSP) response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimately signed OCSP response for an unrelated certificate issued by the same Certificate Authority, leading to a replay attack. This can result in the acceptance of revoked certificates, potentially compromising the integrity and confidentiality of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty\u0027s `OcspClient` that could allow a remote attacker to bypass certificate revocation checks. By replaying a valid OCSP response for an unrelated certificate from the same Certificate Authority, an attacker could trick a client into accepting a revoked certificate, thereby compromising the integrity and confidentiality of communications. Exploitation requires high attack complexity, indicating specific conditions or attacker preparation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56820"
},
{
"category": "external",
"summary": "RHBZ#2505982",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505982"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56820"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg",
"url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
}
],
"release_date": "2026-07-21T22:26:16.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack"
},
{
"cve": "CVE-2026-59899",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507482"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Netty\u0027s HTTP decoder, which could lead to a denial of service. Red Hat products utilizing `netty-codec-http` are susceptible to memory exhaustion when processing specially crafted, highly compressed HTTP payloads. This allows a remote attacker to trigger excessive memory allocation, impacting system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59899"
},
{
"category": "external",
"summary": "RHBZ#2507482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
},
{
"category": "external",
"summary": "https://netty.io/news/2026/07/09/4-1-136-Final.html",
"url": "https://netty.io/news/2026/07/09/4-1-136-Final.html"
}
],
"release_date": "2026-07-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T14:50:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…