RHSA-2026:69459

Vulnerability from csaf_redhat - Published: 2026-09-21 14:38 - Updated: 2026-09-22 15:46
Summary
Red Hat Security Advisory: AMQ Clients 2026.Q3
Severity
Important
Notes
Topic: An update is now available for Red Hat AMQ Clients Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Each Red Hat AMQ Client enables sending, and receiving messages to or from AMQ Broker 7. This update provides various bug fixes and enhancements in addition to the client package versions previously released on Red Hat Enterprise Linux 8, 9 and 10. Security Fix(es): * protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67590) * proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-66257) * proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [amq-cl-2026.Q1] (CVE-2026-66273) * proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-66274) * protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67588) * protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67589) * jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [amq-cl-2026.Q1] (CVE-2026-68494) * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [amq-cl-2026.Q1] (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [amq-cl-2026.Q1] (CVE-2026-54512) * artemis-core-client: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame [amq-cl-2026.Q1] (CVE-2026-50734) * kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA [amq-cl-2026.Q1] (CVE-2026-57915) * micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [amq-cl-2026.Q1] (CVE-2026-40983) * micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [amq-cl-2026.Q1] (CVE-2026-40984) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [amq-cl-2026.Q1] (CVE-2026-45416) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [amq-cl-2026.Q1] (CVE-2026-50010) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [amq-cl-2026.Q1] (CVE-2026-44249) * assertj-core: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) [amq-cl-2025.Q2] (CVE-2026-24400) * netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder [amq-cl-2026.Q1] (CVE-2026-42583) * netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [amq-cl-2026.Q1] (CVE-2026-42587) * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [amq-cl-2026.Q1] (CVE-2026-42578) * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [amq-cl-2026.Q1] (CVE-2026-42581) * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [amq-cl-2026.Q1] (CVE-2026-42584) * spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [amq-cl-2026.Q1] (CVE-2026-40975) * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [amq-cl-2026.Q1] (CVE-2026-33870) * spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path [amq-cl-2026.Q1] (CVE-2026-22731) * qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67465) * qpid-proton-dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67551) * qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67552) Bug Fixes and Improvements: * ENTMQCL-4576 [qpid-jms] The combination of NMS DotNet AMQP producer and qpid-jms consumer doesn't handle the type of JMSReplyTo correctly. * ENTMQCL-4574 [qpid-jms] Update kerb-simplekdc test dep to 2.1.2 * ENTMQCL-4573 [qpid-jms] Update ActiveMQ version in compatibility tests to 5.19.9 * ENTMQCL-4572 [qpid-jms] Update JUnit to version 5.14.4 * ENTMQCL-4571 [qpid-jms] Update commons io to version 2.22.0 * ENTMQCL-4570 [qpid-jms] Update mockito to v5.23.0 * ENTMQCL-4569 [qpid-jms] Update slf4j to version 2.0.18 * ENTMQCL-4568 [qpid-jms] Update jacoco plugin to 0.8.15 * ENTMQCL-4567 [qpid-jms] Update to Netty 4.1.137.Final * ENTMQCL-4566 [qpid-jms] JMSConsumer receiveBody should throw if message is a bare Message instance * ENTMQCL-4564 [protonj2] Update junit to v5.14.4 * ENTMQCL-4563 [protonj2] Update netty to latest release 4.1.137.Final * ENTMQCL-4562 [protonj2] Update proton-j test dependency to v0.35.0 * ENTMQCL-4561 [protonj2] ROUND_ROBIN policy implementation error * ENTMQCL-4560 [protonj2] Inconsistent has result returned from Binary type * ENTMQCL-4365 [protonj2] Unit tests fails on io_uring detection For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-22731

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-305 - Authentication Bypass by Primary Weakness
Affected products
Product Identifier Version Remediation
AMQ Clients 2026.Q3
Red Hat / Red Hat AMQ Clients
 cpe:/a:redhat:amq_clients:2026.Q3 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-24400

A flaw was found in AssertJ. An XML External Entity (XXE) vulnerability exists in the `XmlStringPrettyFormatter` component, which is used by the `isXmlEqualTo(CharSequence)` assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read arbitrary local files, perform Server-Side Request Forgery (SSRF) by making the server request arbitrary URLs, or cause a Denial of Service (DoS) through entity expansion attacks.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-611 - Improper Restriction of XML External Entity Reference
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Moderate
CVE-2026-33870

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-40975

A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-40983

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC (gRPC Remote Procedure Call) requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-40984

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-42578

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-42581

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-42583

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-42584

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-42587

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-44249

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-50010

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-50734

A flaw was found in Apache ActiveMQ. An unauthenticated network attacker can exploit this vulnerability by sending a specially crafted WireFormatInfo frame with an excessively large size value. This unvalidated value causes the broker to attempt an oversized memory allocation during pre-authentication negotiation. Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-54512

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-54513

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-184 - Incomplete List of Disallowed Inputs
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-57915

A flaw was found in Apache Kerby. An attacker can bypass the Kerberos pre-authentication check by sending a Pre-Authentication Data (PA-DATA) packet with an unrecognized or unsupported type. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-66257

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-66273

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-66274

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67465

A flaw was found in Apache Qpid Proton-Dotnet. A remote, unauthenticated attacker could exploit this vulnerability by leveraging unbounded symbol value caching, which can lead to resource exhaustion. This can cause a denial of service (DoS), making the affected system unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67551

A flaw was found in Apache Qpid Proton Dotnet. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts. This could lead to excessive memory allocation, resulting in a denial of service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67552

A flaw was found in Apache Qpid Proton-Dotnet. This vulnerability allows a remote attacker, without needing to authenticate, to exploit a weakness in how the software handles data structures with excessive nesting. This can lead to a StackOverflowError, which ultimately results in a denial of service (DoS), making the system unresponsive or unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67588

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service (DoS) for legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67589

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service (DoS), making the affected system unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-67590

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
CVE-2026-68494

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-22731
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:69459 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2433116 external
https://bugzilla.redhat.com/show_bug.cgi?id=2449290 external
https://bugzilla.redhat.com/show_bug.cgi?id=2452453 external
https://bugzilla.redhat.com/show_bug.cgi?id=2463331 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477224 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477226 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477232 external
https://bugzilla.redhat.com/show_bug.cgi?id=2486697 external
https://bugzilla.redhat.com/show_bug.cgi?id=2486716 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492010 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492015 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493407 external
https://bugzilla.redhat.com/show_bug.cgi?id=2494841 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511321 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511322 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511324 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511326 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511327 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511330 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511337 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511346 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511355 external
https://issues.redhat.com/browse/ENTMQCL-4560 external
https://issues.redhat.com/browse/ENTMQCL-4561 external
https://issues.redhat.com/browse/ENTMQCL-4562 external
https://issues.redhat.com/browse/ENTMQCL-4563 external
https://issues.redhat.com/browse/ENTMQCL-4564 external
https://issues.redhat.com/browse/ENTMQCL-4566 external
https://issues.redhat.com/browse/ENTMQCL-4567 external
https://issues.redhat.com/browse/ENTMQCL-4568 external
https://issues.redhat.com/browse/ENTMQCL-4569 external
https://issues.redhat.com/browse/ENTMQCL-4570 external
https://issues.redhat.com/browse/ENTMQCL-4571 external
https://issues.redhat.com/browse/ENTMQCL-4572 external
https://issues.redhat.com/browse/ENTMQCL-4573 external
https://issues.redhat.com/browse/ENTMQCL-4574 external
https://issues.redhat.com/browse/ENTMQCL-4575 external
https://issues.redhat.com/browse/ENTMQCL-4576 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-22731 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449290 external
https://www.cve.org/CVERecord?id=CVE-2026-22731 external
https://nvd.nist.gov/vuln/detail/CVE-2026-22731 external
https://spring.io/security/cve-2026-22731 external
https://access.redhat.com/security/cve/CVE-2026-24400 self
https://bugzilla.redhat.com/show_bug.cgi?id=2433116 external
https://www.cve.org/CVERecord?id=CVE-2026-24400 external
https://nvd.nist.gov/vuln/detail/CVE-2026-24400 external
https://cheatsheetseries.owasp.org/cheatsheets/XM… external
https://github.com/assertj/assertj/commit/85ca7eb… external
https://github.com/assertj/assertj/releases/tag/a… external
https://github.com/assertj/assertj/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-33870 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452453 external
https://www.cve.org/CVERecord?id=CVE-2026-33870 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33870 external
https://github.com/netty/netty/security/advisorie… external
https://w4ke.info/2025/06/18/funky-chunks.html external
https://w4ke.info/2025/10/29/funky-chunks-2.html external
https://www.rfc-editor.org/rfc/rfc9110 external
https://access.redhat.com/security/cve/CVE-2026-40975 self
https://bugzilla.redhat.com/show_bug.cgi?id=2463331 external
https://www.cve.org/CVERecord?id=CVE-2026-40975 external
https://nvd.nist.gov/vuln/detail/CVE-2026-40975 external
https://spring.io/security/cve-2026-40975 external
https://access.redhat.com/security/cve/CVE-2026-40983 self
https://bugzilla.redhat.com/show_bug.cgi?id=2486697 external
https://www.cve.org/CVERecord?id=CVE-2026-40983 external
https://nvd.nist.gov/vuln/detail/CVE-2026-40983 external
https://spring.io/security/cve-2026-40983 external
https://access.redhat.com/security/cve/CVE-2026-40984 self
https://bugzilla.redhat.com/show_bug.cgi?id=2486716 external
https://www.cve.org/CVERecord?id=CVE-2026-40984 external
https://nvd.nist.gov/vuln/detail/CVE-2026-40984 external
https://spring.io/security/cve-2026-40984 external
https://access.redhat.com/security/cve/CVE-2026-42578 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477226 external
https://www.cve.org/CVERecord?id=CVE-2026-42578 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42578 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42581 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477232 external
https://www.cve.org/CVERecord?id=CVE-2026-42581 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42581 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42583 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://www.cve.org/CVERecord?id=CVE-2026-42583 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42583 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42584 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477224 external
https://www.cve.org/CVERecord?id=CVE-2026-42584 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42584 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42587 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://www.cve.org/CVERecord?id=CVE-2026-42587 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42587 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44249 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://www.cve.org/CVERecord?id=CVE-2026-44249 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44249 external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45416 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://www.cve.org/CVERecord?id=CVE-2026-45416 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45416 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://www.cve.org/CVERecord?id=CVE-2026-50010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50010 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50734 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494841 external
https://www.cve.org/CVERecord?id=CVE-2026-50734 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50734 external
https://lists.apache.org/thread/nxso951fnvf72qf9m… external
https://access.redhat.com/security/cve/CVE-2026-54512 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492015 external
https://www.cve.org/CVERecord?id=CVE-2026-54512 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54512 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-54513 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492010 external
https://www.cve.org/CVERecord?id=CVE-2026-54513 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54513 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/pull/5984 external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-57915 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493407 external
https://www.cve.org/CVERecord?id=CVE-2026-57915 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57915 external
https://lists.apache.org/thread/1y3glgh3kzwoxo5m2… external
https://access.redhat.com/security/cve/CVE-2026-66257 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511326 external
https://www.cve.org/CVERecord?id=CVE-2026-66257 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66257 external
https://lists.apache.org/thread/dnczt6bgfcq2x6q8l… external
https://access.redhat.com/security/cve/CVE-2026-66273 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511322 external
https://www.cve.org/CVERecord?id=CVE-2026-66273 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66273 external
https://lists.apache.org/thread/z34s9v5w05qk4qqtz… external
https://access.redhat.com/security/cve/CVE-2026-66274 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511337 external
https://www.cve.org/CVERecord?id=CVE-2026-66274 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66274 external
https://lists.apache.org/thread/h7xolzws2by2qhdjf… external
https://access.redhat.com/security/cve/CVE-2026-67465 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511327 external
https://www.cve.org/CVERecord?id=CVE-2026-67465 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67465 external
https://lists.apache.org/thread/zl2pj5fo32lbyrwof… external
https://access.redhat.com/security/cve/CVE-2026-67551 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511330 external
https://www.cve.org/CVERecord?id=CVE-2026-67551 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67551 external
https://lists.apache.org/thread/o566fhkrr3gg0lyzt… external
https://access.redhat.com/security/cve/CVE-2026-67552 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511346 external
https://www.cve.org/CVERecord?id=CVE-2026-67552 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67552 external
https://lists.apache.org/thread/4dyg0gycrv55ox4oy… external
https://access.redhat.com/security/cve/CVE-2026-67588 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511324 external
https://www.cve.org/CVERecord?id=CVE-2026-67588 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67588 external
https://lists.apache.org/thread/vk4j02dzggfdrdkwv… external
https://access.redhat.com/security/cve/CVE-2026-67589 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511321 external
https://www.cve.org/CVERecord?id=CVE-2026-67589 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67589 external
https://lists.apache.org/thread/bs24x4778dh72xtfs… external
https://access.redhat.com/security/cve/CVE-2026-67590 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511355 external
https://www.cve.org/CVERecord?id=CVE-2026-67590 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67590 external
https://lists.apache.org/thread/kmov6k7f3moqy01m1… external
https://access.redhat.com/security/cve/CVE-2026-68494 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://www.cve.org/CVERecord?id=CVE-2026-68494 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68494 external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/pull/1611 external
https://github.com/FasterXML/jackson-core/securit… external
https://github.com/advisories/GHSA-72hv-8253-57qq external
https://www.cve.org/CVERecord?id=CVE-2026-18401 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat AMQ Clients\n\nRed Hat Product Security has rated this update as having an impact of\nImportant.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed\nseverity rating, is available for each vulnerability from the CVE link(s) in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Each Red Hat AMQ Client enables sending, and receiving messages to or from AMQ Broker 7.\n\nThis update provides various bug fixes and enhancements in addition to the\nclient package versions previously released on Red Hat Enterprise Linux 8, 9\nand 10.\n\nSecurity Fix(es):\n\n* protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67590)\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-66257)\n* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [amq-cl-2026.Q1] (CVE-2026-66273)\n* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-66274)\n* protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67588)\n* protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67589)\n* jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [amq-cl-2026.Q1] (CVE-2026-68494)\n* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [amq-cl-2026.Q1] (CVE-2026-54513)\n* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [amq-cl-2026.Q1] (CVE-2026-54512)\n* artemis-core-client: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame [amq-cl-2026.Q1] (CVE-2026-50734)\n* kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA [amq-cl-2026.Q1] (CVE-2026-57915)\n* micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [amq-cl-2026.Q1] (CVE-2026-40983)\n* micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [amq-cl-2026.Q1] (CVE-2026-40984)\n* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [amq-cl-2026.Q1] (CVE-2026-45416)\n* netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [amq-cl-2026.Q1] (CVE-2026-50010)\n* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [amq-cl-2026.Q1] (CVE-2026-44249)\n* assertj-core: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) [amq-cl-2025.Q2] (CVE-2026-24400)\n* netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder [amq-cl-2026.Q1] (CVE-2026-42583)\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [amq-cl-2026.Q1] (CVE-2026-42587)\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [amq-cl-2026.Q1] (CVE-2026-42578)\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [amq-cl-2026.Q1] (CVE-2026-42581)\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [amq-cl-2026.Q1] (CVE-2026-42584)\n* spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [amq-cl-2026.Q1] (CVE-2026-40975)\n* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [amq-cl-2026.Q1] (CVE-2026-33870)\n* spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path [amq-cl-2026.Q1] (CVE-2026-22731)\n* qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67465)\n* qpid-proton-dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67551)\n* qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67552)\n\nBug Fixes and Improvements:\n\n* ENTMQCL-4576 [qpid-jms] The combination of NMS DotNet AMQP producer and qpid-jms consumer doesn\u0027t handle the type of JMSReplyTo correctly.\n* ENTMQCL-4574 [qpid-jms] Update kerb-simplekdc test dep to 2.1.2\n* ENTMQCL-4573 [qpid-jms] Update ActiveMQ version in compatibility tests to 5.19.9\n* ENTMQCL-4572 [qpid-jms] Update JUnit to version 5.14.4\n* ENTMQCL-4571 [qpid-jms] Update commons io to version 2.22.0\n* ENTMQCL-4570 [qpid-jms] Update mockito to v5.23.0\n* ENTMQCL-4569 [qpid-jms] Update slf4j to version 2.0.18\n* ENTMQCL-4568 [qpid-jms] Update jacoco plugin to 0.8.15\n* ENTMQCL-4567 [qpid-jms] Update to Netty 4.1.137.Final\n* ENTMQCL-4566 [qpid-jms] JMSConsumer receiveBody should throw if message is a bare Message instance\n* ENTMQCL-4564 [protonj2] Update junit to v5.14.4\n* ENTMQCL-4563 [protonj2] Update netty to latest release 4.1.137.Final\n* ENTMQCL-4562 [protonj2] Update proton-j test dependency to v0.35.0\n* ENTMQCL-4561 [protonj2] ROUND_ROBIN policy implementation error\n* ENTMQCL-4560 [protonj2] Inconsistent has result returned from Binary type\n* ENTMQCL-4365 [protonj2] Unit tests fails on io_uring detection\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:69459",
        "url": "https://access.redhat.com/errata/RHSA-2026:69459"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2433116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433116"
      },
      {
        "category": "external",
        "summary": "2449290",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
      },
      {
        "category": "external",
        "summary": "2452453",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
      },
      {
        "category": "external",
        "summary": "2463331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
      },
      {
        "category": "external",
        "summary": "2477219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
      },
      {
        "category": "external",
        "summary": "2477220",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
      },
      {
        "category": "external",
        "summary": "2477224",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
      },
      {
        "category": "external",
        "summary": "2477226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
      },
      {
        "category": "external",
        "summary": "2477232",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
      },
      {
        "category": "external",
        "summary": "2486697",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486697"
      },
      {
        "category": "external",
        "summary": "2486716",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
      },
      {
        "category": "external",
        "summary": "2488081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
      },
      {
        "category": "external",
        "summary": "2488391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
      },
      {
        "category": "external",
        "summary": "2488429",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
      },
      {
        "category": "external",
        "summary": "2492010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
      },
      {
        "category": "external",
        "summary": "2492015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
      },
      {
        "category": "external",
        "summary": "2493407",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493407"
      },
      {
        "category": "external",
        "summary": "2494841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494841"
      },
      {
        "category": "external",
        "summary": "2511026",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
      },
      {
        "category": "external",
        "summary": "2511321",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511321"
      },
      {
        "category": "external",
        "summary": "2511322",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
      },
      {
        "category": "external",
        "summary": "2511324",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511324"
      },
      {
        "category": "external",
        "summary": "2511326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
      },
      {
        "category": "external",
        "summary": "2511327",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511327"
      },
      {
        "category": "external",
        "summary": "2511330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511330"
      },
      {
        "category": "external",
        "summary": "2511337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
      },
      {
        "category": "external",
        "summary": "2511346",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511346"
      },
      {
        "category": "external",
        "summary": "2511355",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511355"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4560",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4560"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4561",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4561"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4562",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4562"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4563",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4563"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4564",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4564"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4566",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4566"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4567",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4567"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4568",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4568"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4569",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4569"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4570",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4570"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4571",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4571"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4572",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4572"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4573",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4573"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4574",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4574"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4575",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4575"
      },
      {
        "category": "external",
        "summary": "ENTMQCL-4576",
        "url": "https://issues.redhat.com/browse/ENTMQCL-4576"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69459.json"
      }
    ],
    "title": "Red Hat Security Advisory: AMQ Clients 2026.Q3",
    "tracking": {
      "current_release_date": "2026-09-22T15:46:57+00:00",
      "generator": {
        "date": "2026-09-22T15:46:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:69459",
      "initial_release_date": "2026-09-21T14:38:54+00:00",
      "revision_history": [
        {
          "date": "2026-09-21T14:38:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-21T14:38:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-22T15:46:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AMQ Clients 2026.Q3",
                "product": {
                  "name": "AMQ Clients 2026.Q3",
                  "product_id": "AMQ Clients 2026.Q3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_clients:2026.Q3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AMQ Clients"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22731",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-03-19T23:02:37.111109+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449290"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22731"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449290",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22731",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22731"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2026-22731",
          "url": "https://spring.io/security/cve-2026-22731"
        }
      ],
      "release_date": "2026-03-19T22:36:15.112000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application\u0027s configuration to prevent this overlap. A redeployment of the application is required for changes to take effect.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path"
    },
    {
      "cve": "CVE-2026-24400",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2026-01-26T23:01:28.099083+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AssertJ. An XML External Entity (XXE) vulnerability exists in the `XmlStringPrettyFormatter` component, which is used by the `isXmlEqualTo(CharSequence)` assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read arbitrary local files, perform Server-Side Request Forgery (SSRF) by making the server request arbitrary URLs, or cause a Denial of Service (DoS) through entity expansion attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this vulnerability requires that a user processes untrusted content with the affected package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24400"
        },
        {
          "category": "external",
          "summary": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a",
          "url": "https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a"
        },
        {
          "category": "external",
          "summary": "https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7",
          "url": "https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r",
          "url": "https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r"
        }
      ],
      "release_date": "2026-01-26T22:19:02.161000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)"
    },
    {
      "cve": "CVE-2026-33870",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-27T21:01:59.865839+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
          "url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110",
          "url": "https://www.rfc-editor.org/rfc/rfc9110"
        }
      ],
      "release_date": "2026-03-27T19:54:15.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
    },
    {
      "cve": "CVE-2026-40975",
      "cwe": {
        "id": "CWE-338",
        "name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
      },
      "discovery_date": "2026-04-28T00:01:58.716976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40975"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40975",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40975"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2026-40975",
          "url": "https://spring.io/security/cve-2026-40975"
        }
      ],
      "release_date": "2026-04-27T23:32:58.596000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure."
    },
    {
      "cve": "CVE-2026-40983",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-09T05:00:52.290020+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486697"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC (gRPC Remote Procedure Call) requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial-of-service vulnerability in Micrometer, as a remote unauthenticated attacker can disrupt the availability of affected systems by sending specially crafted gRPC requests. The broad accessibility of gRPC endpoints in typical deployments contributes to the elevated risk, allowing for significant service interruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40983"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486697",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486697"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40983",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40983"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40983",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40983"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2026-40983",
          "url": "https://spring.io/security/cve-2026-40983"
        }
      ],
      "release_date": "2026-06-09T03:46:54.131000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services exposing Micrometer\u0027s gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential for the deployment, consider disabling it entirely to eliminate the attack vector. Any changes to network configurations or service settings may require a service restart to take effect, potentially impacting availability during the transition.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests"
    },
    {
      "cve": "CVE-2026-40984",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-09T05:01:51.700197+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486716"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial-of-service vulnerability in Micrometer, a component present in several Red Hat products. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests, leading to resource exhaustion and disrupting the availability of affected services. Exploitation of this flaw requires one or more HTTP server instrumentation(s), from one of the vulnerable components, to be configured to record metrics.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40984"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486716",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40984",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40984"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984"
        },
        {
          "category": "external",
          "summary": "https://spring.io/security/cve-2026-40984",
          "url": "https://spring.io/security/cve-2026-40984"
        }
      ],
      "release_date": "2026-06-09T03:47:46.447000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests"
    },
    {
      "cve": "CVE-2026-42578",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:00.826936+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        }
      ],
      "release_date": "2026-05-13T17:57:43.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
    },
    {
      "cve": "CVE-2026-42581",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:02:26.404511+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477232"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477232",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        }
      ],
      "release_date": "2026-05-13T17:54:44.492000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
    },
    {
      "cve": "CVE-2026-42583",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:32.498598+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Netty\u0027s LZ4FrameDecoder. The decoder allocates a buffer based on the decompressed length from the LZ4 frame header (up to 32 MB per block) before decompression runs. A remote attacker can send a small crafted LZ4 header (as few as 22 bytes) to force excessive memory allocation, leading to a denial of service. Red Hat products that use Netty with LZ4 compression enabled are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"
        }
      ],
      "release_date": "2026-05-13T18:09:19.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder"
    },
    {
      "cve": "CVE-2026-42584",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-05-13T19:01:51.846351+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477224"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477224",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
        }
      ],
      "release_date": "2026-05-13T18:10:48.437000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
    },
    {
      "cve": "CVE-2026-42587",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:35.415881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477220"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477220",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "release_date": "2026-05-13T18:22:21.699000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
    },
    {
      "cve": "CVE-2026-44249",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-06-11T22:02:05.327173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
        }
      ],
      "release_date": "2026-06-11T20:46:14.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
    },
    {
      "cve": "CVE-2026-45416",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:01:45.671884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
        }
      ],
      "release_date": "2026-06-12T14:10:05.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
    },
    {
      "cve": "CVE-2026-50010",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-12T16:02:13.735675+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
        }
      ],
      "release_date": "2026-06-12T14:50:43.151000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
    },
    {
      "cve": "CVE-2026-50734",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-30T11:01:32.070962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494841"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache ActiveMQ. An unauthenticated network attacker can exploit this vulnerability by sending a specially crafted WireFormatInfo frame with an excessively large size value. This unvalidated value causes the broker to attempt an oversized memory allocation during pre-authentication negotiation. Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache ActiveMQ Classic\u0027s OpenWire protocol handling. An unauthenticated remote attacker can crash the broker by sending a crafted WireFormatInfo frame with a malicious oversized value during pre-authentication protocol negotiation, causing an Out of Memory condition. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, but its OpenWire protocol support delegates wire format negotiation to Classic ActiveMQ\u0027s activemq-client code, which is vulnerable to this attack on the OpenWire listener port.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494841",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494841"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0",
          "url": "https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0"
        }
      ],
      "release_date": "2026-06-30T09:53:03.435000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame"
    },
    {
      "cve": "CVE-2026-54512",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-23T22:01:49.821346+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        }
      ],
      "release_date": "2026-06-23T20:56:36.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
    },
    {
      "cve": "CVE-2026-54513",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2026-06-23T22:01:34.437620+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
          "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5981"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5983"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
          "url": "https://github.com/FasterXML/jackson-databind/pull/5984"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
        }
      ],
      "release_date": "2026-06-23T20:53:52.543000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
    },
    {
      "cve": "CVE-2026-57915",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-06-26T13:00:52.106682+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493407"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Kerby. An attacker can bypass the Kerberos pre-authentication check by sending a Pre-Authentication Data (PA-DATA) packet with an unrecognized or unsupported type. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Apache Kerby, affecting Red Hat products that utilize Kerberos for authentication, including Red Hat AMQ, JBoss Data Grid, Enterprise Application Platform, and Red Hat JBoss Fuse. The vulnerability allows an attacker to bypass the Kerberos pre-authentication check by sending a specially crafted Pre-Authentication Data (PA-DATA) packet. This circumvents an initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57915"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493407",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493407"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57915",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57915"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57915",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57915"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh",
          "url": "https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh"
        }
      ],
      "release_date": "2026-06-26T12:09:54.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA"
    },
    {
      "cve": "CVE-2026-66257",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:01:13.741100+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Apache Qpid Proton-J, allowing a pre-authentication attacker to exhaust system resources through unbounded symbol value caching. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability\u0027s impact is significant due to the potential for unauthenticated remote attackers to disrupt service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66257"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm",
          "url": "https://lists.apache.org/thread/dnczt6bgfcq2x6q8ljco177h1qmv59fm"
        }
      ],
      "release_date": "2026-08-05T05:18:01.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching"
    },
    {
      "cve": "CVE-2026-66273",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:01:00.913036+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Qpid Proton-J allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66273"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66273",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66273"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66273"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh",
          "url": "https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh"
        }
      ],
      "release_date": "2026-08-05T05:23:31.964000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation"
    },
    {
      "cve": "CVE-2026-66274",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T07:00:53.637061+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66274"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66274",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66274"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66274"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h",
          "url": "https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h"
        }
      ],
      "release_date": "2026-08-05T05:29:44.681000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting"
    },
    {
      "cve": "CVE-2026-67465",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:01:16.543090+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511327"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton-Dotnet. A remote, unauthenticated attacker could exploit this vulnerability by leveraging unbounded symbol value caching, which can lead to resource exhaustion. This can cause a denial of service (DoS), making the affected system unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67465"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511327",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511327"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67465",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67465"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67465",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67465"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/zl2pj5fo32lbyrwof89tdyrgt67bbo0m",
          "url": "https://lists.apache.org/thread/zl2pj5fo32lbyrwof89tdyrgt67bbo0m"
        }
      ],
      "release_date": "2026-08-05T05:21:04.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching"
    },
    {
      "cve": "CVE-2026-67551",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:01:26.873523+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton Dotnet. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts. This could lead to excessive memory allocation, resulting in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Qpid Proton-Dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511330"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67551"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/o566fhkrr3gg0lyzt24xwvz9w94oo6ro",
          "url": "https://lists.apache.org/thread/o566fhkrr3gg0lyzt24xwvz9w94oo6ro"
        }
      ],
      "release_date": "2026-08-05T05:27:24.551000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Qpid Proton-Dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation"
    },
    {
      "cve": "CVE-2026-67552",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T07:01:16.560219+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511346"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid Proton-Dotnet. This vulnerability allows a remote attacker, without needing to authenticate, to exploit a weakness in how the software handles data structures with excessive nesting. This can lead to a StackOverflowError, which ultimately results in a denial of service (DoS), making the system unresponsive or unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Qpid Proton-Dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67552"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511346",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511346"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67552",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67552"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67552",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67552"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/4dyg0gycrv55ox4oywqght61b053g8xj",
          "url": "https://lists.apache.org/thread/4dyg0gycrv55ox4oywqght61b053g8xj"
        }
      ],
      "release_date": "2026-08-05T05:32:58.378000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Qpid Proton-Dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting"
    },
    {
      "cve": "CVE-2026-67588",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:01:07.594327+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511324"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service (DoS) for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67588"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511324",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511324"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67588",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67588"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67588",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67588"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt",
          "url": "https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt"
        }
      ],
      "release_date": "2026-08-05T05:21:44.240000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching"
    },
    {
      "cve": "CVE-2026-67589",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T06:00:58.265386+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511321"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service (DoS), making the affected system unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67589"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511321",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511321"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67589",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67589"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67589",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67589"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q",
          "url": "https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q"
        }
      ],
      "release_date": "2026-08-05T05:28:15.054000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation"
    },
    {
      "cve": "CVE-2026-67590",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-05T07:01:42.112809+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qpid-protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67590"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67590",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67590"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67590",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67590"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly",
          "url": "https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly"
        }
      ],
      "release_date": "2026-08-05T05:33:39.626000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qpid-protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting"
    },
    {
      "cve": "CVE-2026-68494",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-04T15:01:53.631865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511026"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AMQ Clients 2026.Q3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511026",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
          "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
          "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
          "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1611",
          "url": "https://github.com/FasterXML/jackson-core/pull/1611"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
        }
      ],
      "release_date": "2026-08-04T14:39:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-21T14:38:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AMQ Clients 2026.Q3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:69459"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AMQ Clients 2026.Q3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.