RHSA-2026:70257
Vulnerability from csaf_redhat - Published: 2026-09-22 14:01 - Updated: 2026-10-08 23:36Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
Severity
Important
Notes
Topic: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of Important.
Details: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [rhboac-camel-quarkus-3] (CVE-2026-90852)
* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [rhboac-camel-quarkus-3] (CVE-2026-12860)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [rhboac-camel-quarkus-3] (CVE-2026-58059)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [rhboac-camel-quarkus-3] (CVE-2026-90560)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [rhboac-camel-quarkus-3] (CVE-2026-89046)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [rhboac-camel-quarkus-3] (CVE-2026-87824)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [rhboac-camel-quarkus-3] (CVE-2026-87795)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [rhboac-camel-quarkus-3] (CVE-2026-87877)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [rhboac-camel-quarkus-3] (CVE-2026-87825)
* wire-runtime: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)
* wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)
* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [rhboac-camel-quarkus-3] (CVE-2026-59649)
* wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [rhboac-camel-quarkus-3] (CVE-2026-19611)
* hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [rhboac-camel-quarkus-3] (CVE-2026-77874)
* netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY
streams [rhboac-camel-quarkus-3] (CVE-2026-93488)
* netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec
HTTP/1.1 pipeline queue [rhboac-camel-quarkus-3] (CVE-2026-93491)
* netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in
WebSocketServerExtensionHandler Leads to Denial of Service
[rhboac-camel-quarkus-3] (CVE-2026-93558)
* netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf
reference-count leak (incomplete fix of PR #16881) [rhboac-camel-quarkus-3]
(CVE-2026-93564)
* netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing
Control Byte [rhboac-camel-quarkus-3] (CVE-2026-93565)
* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed
HTTP/2 CONNECT with Host-controlled :authority [rhboac-camel-quarkus-3]
(CVE-2026-93567)
* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are
downgraded as regular CONNECT requests [rhboac-camel-quarkus-3] (CVE-2026-93568)
* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2
:authority, overriding the request-target authority [rhboac-camel-quarkus-3]
(CVE-2026-93569)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Moderate
A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory location, leading to a denial of service (DoS) by crashing affected services.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.
8.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12860
Threats
Impact
Important
References
165 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Important.",
"title": "Topic"
},
{
"category": "general",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [rhboac-camel-quarkus-3] (CVE-2026-90852)\n* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [rhboac-camel-quarkus-3] (CVE-2026-12860)\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [rhboac-camel-quarkus-3] (CVE-2026-58059)\n* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [rhboac-camel-quarkus-3] (CVE-2026-90560)\n* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [rhboac-camel-quarkus-3] (CVE-2026-89046)\n* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [rhboac-camel-quarkus-3] (CVE-2026-87824)\n* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [rhboac-camel-quarkus-3] (CVE-2026-87795)\n* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [rhboac-camel-quarkus-3] (CVE-2026-87877)\n* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [rhboac-camel-quarkus-3] (CVE-2026-87825)\n* wire-runtime: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)\n* wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)\n* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [rhboac-camel-quarkus-3] (CVE-2026-59649)\n* wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [rhboac-camel-quarkus-3] (CVE-2026-19611)\n* hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [rhboac-camel-quarkus-3] (CVE-2026-77874)\n* netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY\nstreams [rhboac-camel-quarkus-3] (CVE-2026-93488)\n* netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec\nHTTP/1.1 pipeline queue [rhboac-camel-quarkus-3] (CVE-2026-93491)\n* netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in\nWebSocketServerExtensionHandler Leads to Denial of Service\n[rhboac-camel-quarkus-3] (CVE-2026-93558)\n* netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf\nreference-count leak (incomplete fix of PR #16881) [rhboac-camel-quarkus-3]\n(CVE-2026-93564)\n* netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing\nControl Byte [rhboac-camel-quarkus-3] (CVE-2026-93565)\n* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed\nHTTP/2 CONNECT with Host-controlled :authority [rhboac-camel-quarkus-3]\n(CVE-2026-93567)\n* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are\ndowngraded as regular CONNECT requests [rhboac-camel-quarkus-3] (CVE-2026-93568)\n* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2\n:authority, overriding the request-target authority [rhboac-camel-quarkus-3]\n(CVE-2026-93569)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:70257",
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-90852",
"url": "https://access.redhat.com/security/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12860",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58059",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-90560",
"url": "https://access.redhat.com/security/cve/CVE-2026-90560"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-89046",
"url": "https://access.redhat.com/security/cve/CVE-2026-89046"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87824",
"url": "https://access.redhat.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87795",
"url": "https://access.redhat.com/security/cve/CVE-2026-87795"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87877",
"url": "https://access.redhat.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87825",
"url": "https://access.redhat.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45799",
"url": "https://access.redhat.com/security/cve/CVE-2026-45799"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59649",
"url": "https://access.redhat.com/security/cve/CVE-2026-59649"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19611",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77874",
"url": "https://access.redhat.com/security/cve/CVE-2026-77874"
},
{
"category": "external",
"summary": "2510195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510195"
},
{
"category": "external",
"summary": "2513748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
},
{
"category": "external",
"summary": "2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70257.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)",
"tracking": {
"current_release_date": "2026-10-08T23:36:48+00:00",
"generator": {
"date": "2026-10-08T23:36:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:70257",
"initial_release_date": "2026-09-22T14:01:31+00:00",
"revision_history": [
{
"date": "2026-09-22T14:01:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-22T14:01:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-08T23:36:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2",
"product": {
"name": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2",
"product_id": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_quarkus:3.33"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12860",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:01:02.591427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. During the RSA PKCS#1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the acceptance of forged or malicious data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A signature verification flaw was found in Bouncy Castle for Java\u0027s RSA PKCS#1 parser (`bcprov`). When verifying RSA PKCS#1 v1.5 signatures utilizing a NULL-omitted DigestInfo path, the verification routine incorrectly skips the last two bytes of the expected digest hash. An unauthenticated remote attacker can exploit this truncated comparison to craft forged signatures that pass verification, bypassing cryptographic integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12860"
},
{
"category": "external",
"summary": "RHBZ#2510256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396",
"url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12860"
}
],
"release_date": "2026-08-03T02:55:58.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification"
},
{
"acknowledgments": [
{
"names": [
"LiuBo-keep (aidan)"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-19611",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"discovery_date": "2026-07-24T14:34:50+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "RHBZ#2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
}
],
"release_date": "2026-07-24T14:34:50+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
},
{
"cve": "CVE-2026-45799",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-07-17T21:02:30.932662+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory location, leading to a denial of service (DoS) by crashing affected services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45799"
},
{
"category": "external",
"summary": "RHBZ#2501947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45799",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45799"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45799",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45799"
},
{
"category": "external",
"summary": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0",
"url": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0"
},
{
"category": "external",
"summary": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773",
"url": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773"
},
{
"category": "external",
"summary": "https://github.com/square/wire/pull/3595",
"url": "https://github.com/square/wire/pull/3595"
},
{
"category": "external",
"summary": "https://github.com/square/wire/pull/3597",
"url": "https://github.com/square/wire/pull/3597"
},
{
"category": "external",
"summary": "https://github.com/square/wire/releases/tag/6.3.0",
"url": "https://github.com/square/wire/releases/tag/6.3.0"
},
{
"category": "external",
"summary": "https://github.com/square/wire/releases/tag/7.0.0-alpha03",
"url": "https://github.com/square/wire/releases/tag/7.0.0-alpha03"
},
{
"category": "external",
"summary": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9",
"url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
}
],
"release_date": "2026-07-17T19:49:30.331000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.squareup.wire/wire-runtime: com.squareup.wire/wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-08-03T03:02:32.846217+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510250"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name\u2014such as within an X.509 certificate during TLS handshakes or PKI parsing operations\u2014forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58059"
},
{
"category": "external",
"summary": "RHBZ#2510250",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510250"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58059"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b",
"url": "https://github.com/bcgit/bc-java/commit/7bf20eea8c1b71a4d3574b75ba20ccf26ffff36b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58059"
}
],
"release_date": "2026-08-03T02:41:30.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names"
},
{
"cve": "CVE-2026-59649",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T02:01:15.252829+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510195"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. The software\u0027s processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OpenPGP user-attribute subpacket length is bounded only by the JVM maximum memory, so processing a specially crafted OpenPGP message causes excessive memory consumption and a denial of service. This is reachable only via the OpenPGP (bcpg) code paths; products that do not parse untrusted OpenPGP messages are not exposed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59649"
},
{
"category": "external",
"summary": "RHBZ#2510195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510195"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59649"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59649",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59649"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/a43c40dc12c3e1c6cbd03c83fe30aaec4029b824",
"url": "https://github.com/bcgit/bc-java/commit/a43c40dc12c3e1c6cbd03c83fe30aaec4029b824"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59649",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59649"
}
],
"release_date": "2026-08-03T00:44:24.300000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length"
},
{
"cve": "CVE-2026-77874",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-08-11T01:30:47.988000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513748"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM\u0027s Criteria API.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77874"
},
{
"category": "external",
"summary": "RHBZ#2513748",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513748"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77874"
}
],
"release_date": "2026-09-17T13:30:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to `json_query`, `json_exists`, or `json_value` functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass"
},
{
"cve": "CVE-2026-87795",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T10:21:04.988917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of sensitive native heap memory and cause the Java Virtual Machine (JVM) to crash, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni caused by insufficient validation of offset and length values in the ZstdDictCompress constructor. An attacker who can influence these values may cause a JVM crash and potentially disclose native heap data. Affected Red Hat products are tracked through their existing remediation workflow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87795"
},
{
"category": "external",
"summary": "RHBZ#2530661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87795"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb",
"url": "https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a",
"url": "https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress"
}
],
"release_date": "2026-09-09T10:07:28.656000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service"
},
{
"cve": "CVE-2026-87824",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T14:51:05.674319+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the `Zstd.trainFromBufferDirect` function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately causing the Java Virtual Machine (JVM) to terminate, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87824 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow a remote attacker to terminate the Java Virtual Machine by supplying crafted sample lengths to the dictionary-training function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "RHBZ#2530998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87824"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980",
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"release_date": "2026-09-09T14:32:44.099000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect"
},
{
"cve": "CVE-2026-87825",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T14:52:13.405564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary\u0027s shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after associating it with a stream or context. Subsequent read or write operations would then access freed native memory, leading to silent data corruption or a Java Virtual Machine (JVM) crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in zstd-jni that could lead to silent data corruption or JVM crashes due to a use-after-free vulnerability. The flaw arises when a dictionary is prematurely closed while still actively referenced by compression or decompression streams, potentially impacting Red Hat products that utilize zstd-jni for data handling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "RHBZ#2531007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87825"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"release_date": "2026-09-09T14:32:44.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability"
},
{
"cve": "CVE-2026-87877",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-09T14:51:43.444501+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine (JVM) to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that CVE-2026-87877 affects Red Hat products that include the zstd-jni library in a vulnerable version. The vulnerability can allow memory corruption or denial of service when specific stream methods are called after the stream has been closed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "RHBZ#2531003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87877"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938",
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555",
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e",
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"release_date": "2026-09-09T14:32:45.512000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service"
},
{
"cve": "CVE-2026-89046",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-10T17:51:53.452234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parser. This can lead to out-of-bounds memory reads, resulting in information disclosure or a Java Virtual Machine (JVM) crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of an out-of-bounds read in zstd-jni when a negative source position is supplied to Zstd.getFrameContentSize. This may disclose native memory or cause a JVM crash. Affected Red Hat products are tracked for updates containing zstd-jni 1.5.7-14 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89046"
},
{
"category": "external",
"summary": "RHBZ#2531577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89046"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646",
"url": "https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m",
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset"
}
],
"release_date": "2026-09-10T17:39:35.519000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read"
},
{
"cve": "CVE-2026-90560",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-12T18:10:57.851894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532604"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading to memory being read beyond its allocated buffer. This could result in the termination of the Java Virtual Machine (JVM), causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has determined that affected versions of zstd-jni are vulnerable to an out-of-bounds read in the ZstdDictDecompress constructor. An attacker who can cause an application to supply invalid dictionary offset or length values may terminate the Java Virtual Machine, resulting in denial of service. Red Hat is tracking fixes for affected products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90560"
},
{
"category": "external",
"summary": "RHBZ#2532604",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532604"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90560"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90560"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni",
"url": "https://github.com/luben/zstd-jni"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37",
"url": "https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49",
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f",
"url": "https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/405",
"url": "https://github.com/luben/zstd-jni/issues/405"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress",
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress"
}
],
"release_date": "2026-09-12T18:06:43.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress"
},
{
"cve": "CVE-2026-90852",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-15T02:41:02.899732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, information disclosure, or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important remote use-after-free vulnerability in the `zstd-jni` library\u0027s dictionary sharing functionality. The flaw, affecting the `ZstdCompressCtx.loadDict` function, could allow an unauthenticated attacker to trigger a crash or potentially execute arbitrary code due to public exploit disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "RHBZ#2533566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/",
"url": "https://github.com/luben/zstd-jni/"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936",
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/issues/404",
"url": "https://github.com/luben/zstd-jni/issues/404"
},
{
"category": "external",
"summary": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14",
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-90852",
"url": "https://vuldb.com/cve/CVE-2026-90852"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/927022",
"url": "https://vuldb.com/submit/927022"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407",
"url": "https://vuldb.com/vuln/403407"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/403407/cti",
"url": "https://vuldb.com/vuln/403407/cti"
}
],
"release_date": "2026-09-15T02:15:10.581000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing"
},
{
"cve": "CVE-2026-93488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:39:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "RHBZ#2536887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:39:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
},
{
"cve": "CVE-2026-93491",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:40:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536891"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "RHBZ#2536891",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:40:47+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
},
{
"cve": "CVE-2026-93558",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:42:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "RHBZ#2536932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
}
],
"release_date": "2026-09-10T00:42:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
},
{
"cve": "CVE-2026-93564",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:46:51+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "RHBZ#2536953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
}
],
"release_date": "2026-09-10T00:46:51+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
},
{
"cve": "CVE-2026-93565",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:19+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "RHBZ#2536952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
}
],
"release_date": "2026-09-10T00:47:19+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-22T14:01:31+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70257"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…