Red Hat Product Errata RHSA-2026:37390 - Security Advisory
Issued:
2026-07-09
Updated:
2026-07-09

RHSA-2026:37390 - Security Advisory

Synopsis

Important: Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.

Type/Severity

Security Advisory: Important

Topic

Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available.

The purpose of this text-only errata is to inform you about the security issues fixed.

Security Fix(es):

  • cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection (CVE-2026-44930)
  • cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration (CVE-2026-50632)
  • cxf-rt-rs-security-oauth2-saml: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627)
  • cxf-rt-rs-security-oauth2: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627)
  • cxf-rt-rs-security-oauth2-saml: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628)
  • cxf-rt-rs-security-oauth2: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628)
  • cxf-integration-jca: Apache CXF: Arbitrary code execution via JNDI Injection (CVE-2026-50633)
  • cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening (CVE-2026-49875)
  • netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011)
  • netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250)
  • netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890)
  • netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340)
  • netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
  • netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006)
  • netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
  • netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
  • netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
  • netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
  • netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
  • assertj-core: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400)
  • cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration (CVE-2026-44417)
  • netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header (CVE-2026-44248)
  • netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
  • netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
  • netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
  • netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder (CVE-2026-42586)
  • netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
  • netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)
  • netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
  • log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames (CVE-2026-34478)
  • log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging (CVE-2026-34480)
  • log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output (CVE-2026-34481)
  • micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests (CVE-2026-40984)
  • netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
  • netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Integration - Camel for Spring Boot 1 x86_64

Fixes

  • BZ - 2433116 - CVE-2026-24400 assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)
  • BZ - 2457321 - CVE-2026-34481 org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output
  • BZ - 2457323 - CVE-2026-34478 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames
  • BZ - 2457328 - CVE-2026-34480 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
  • BZ - 2477213 - CVE-2026-42586 netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder
  • BZ - 2477217 - CVE-2026-42579 netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement
  • BZ - 2477220 - CVE-2026-42587 netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
  • BZ - 2477224 - CVE-2026-42584 netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
  • BZ - 2477226 - CVE-2026-42578 netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
  • BZ - 2477231 - CVE-2026-44248 netty: io.netty/netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header
  • BZ - 2477232 - CVE-2026-42581 netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
  • BZ - 2480728 - CVE-2026-44930 apache-cxf: org.apache.cxf.services.xkms/cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection
  • BZ - 2480729 - CVE-2026-44417 org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration
  • BZ - 2486716 - CVE-2026-40984 micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests
  • BZ - 2488053 - CVE-2026-44890 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads
  • BZ - 2488062 - CVE-2026-44250 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays
  • BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
  • BZ - 2488298 - CVE-2026-50627 apache-cxf: org.apache.cxf/cxf-rt-rs-security-oauth2: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims
  • BZ - 2488302 - CVE-2026-50628 cxf: org.apache.cxf/cxf-rt-rs-security-oauth2: cxf: Unauthorized access due to logic error in OAuthRequestFilter
  • BZ - 2488304 - CVE-2026-50632 cxf: org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration
  • BZ - 2488307 - CVE-2026-50633 apache-cxf: org.apache.cxf/cxf-integration-jca: Apache CXF: Arbitrary code execution via JNDI Injection
  • BZ - 2488309 - CVE-2026-49875 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
  • BZ - 2488383 - CVE-2026-44893 netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message
  • BZ - 2488388 - CVE-2026-46340 netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments
  • BZ - 2488391 - CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake
  • BZ - 2488400 - CVE-2026-45674 netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
  • BZ - 2488413 - CVE-2026-50011 netty-codec-redis: Netty: Denial of Service via malicious Redis array header
  • BZ - 2488429 - CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
  • BZ - 2488433 - CVE-2026-48006 netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
  • BZ - 2488437 - CVE-2026-48059 netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers
  • BZ - 2488439 - CVE-2026-47691 io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records
  • BZ - 2488442 - CVE-2026-48043 netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.