Red Hat Product Errata RHSA-2026:69459 - Security Advisory
Issued:
2026-09-21
Updated:
2026-09-21

RHSA-2026:69459 - Security Advisory

Synopsis

Important: AMQ Clients 2026.Q3

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat AMQ Clients

Red Hat Product Security has rated this update as having an impact of
Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed
severity rating, is available for each vulnerability from the CVE link(s) in the
References section.

Description

Each Red Hat AMQ Client enables sending, and receiving messages to or from AMQ Broker 7.

This update provides various bug fixes and enhancements in addition to the
client package versions previously released on Red Hat Enterprise Linux 8, 9
and 10.

Security Fix(es):

  • protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67590)
  • proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-66257)
  • proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [amq-cl-2026.Q1] (CVE-2026-66273)
  • proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-66274)
  • protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67588)
  • protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67589)
  • jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [amq-cl-2026.Q1] (CVE-2026-68494)
  • jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [amq-cl-2026.Q1] (CVE-2026-54513)
  • jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [amq-cl-2026.Q1] (CVE-2026-54512)
  • artemis-core-client: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame [amq-cl-2026.Q1] (CVE-2026-50734)
  • kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA [amq-cl-2026.Q1] (CVE-2026-57915)
  • micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [amq-cl-2026.Q1] (CVE-2026-40983)
  • micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [amq-cl-2026.Q1] (CVE-2026-40984)
  • netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [amq-cl-2026.Q1] (CVE-2026-45416)
  • netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [amq-cl-2026.Q1] (CVE-2026-50010)
  • netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [amq-cl-2026.Q1] (CVE-2026-44249)
  • assertj-core: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) [amq-cl-2025.Q2] (CVE-2026-24400)
  • netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder [amq-cl-2026.Q1] (CVE-2026-42583)
  • netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [amq-cl-2026.Q1] (CVE-2026-42587)
  • netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [amq-cl-2026.Q1] (CVE-2026-42578)
  • netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [amq-cl-2026.Q1] (CVE-2026-42581)
  • netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [amq-cl-2026.Q1] (CVE-2026-42584)
  • spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [amq-cl-2026.Q1] (CVE-2026-40975)
  • netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [amq-cl-2026.Q1] (CVE-2026-33870)
  • spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path [amq-cl-2026.Q1] (CVE-2026-22731)
  • qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching [amq-cl-2026.Q1] (CVE-2026-67465)
  • qpid-proton-dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation [amq-cl-2026.Q1] (CVE-2026-67551)
  • qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting [amq-cl-2026.Q1] (CVE-2026-67552)

Bug Fixes and Improvements:

  • ENTMQCL-4576 [qpid-jms] The combination of NMS DotNet AMQP producer and qpid-jms consumer doesn't handle the type of JMSReplyTo correctly.
  • ENTMQCL-4574 [qpid-jms] Update kerb-simplekdc test dep to 2.1.2
  • ENTMQCL-4573 [qpid-jms] Update ActiveMQ version in compatibility tests to 5.19.9
  • ENTMQCL-4572 [qpid-jms] Update JUnit to version 5.14.4
  • ENTMQCL-4571 [qpid-jms] Update commons io to version 2.22.0
  • ENTMQCL-4570 [qpid-jms] Update mockito to v5.23.0
  • ENTMQCL-4569 [qpid-jms] Update slf4j to version 2.0.18
  • ENTMQCL-4568 [qpid-jms] Update jacoco plugin to 0.8.15
  • ENTMQCL-4567 [qpid-jms] Update to Netty 4.1.137.Final
  • ENTMQCL-4566 [qpid-jms] JMSConsumer receiveBody should throw if message is a bare Message instance
  • ENTMQCL-4564 [protonj2] Update junit to v5.14.4
  • ENTMQCL-4563 [protonj2] Update netty to latest release 4.1.137.Final
  • ENTMQCL-4562 [protonj2] Update proton-j test dependency to v0.35.0
  • ENTMQCL-4561 [protonj2] ROUND_ROBIN policy implementation error
  • ENTMQCL-4560 [protonj2] Inconsistent has result returned from Binary type
  • ENTMQCL-4365 [protonj2] Unit tests fails on io_uring detection

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat JBoss AMQ Clients 3 for RHEL 9 x86_64
  • Red Hat JBoss AMQ Clients 3 for RHEL 8 x86_64

Fixes

  • BZ - 2433116 - CVE-2026-24400 assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)
  • BZ - 2449290 - CVE-2026-22731 Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path
  • BZ - 2452453 - CVE-2026-33870 io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values
  • BZ - 2463331 - CVE-2026-40975 Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.
  • BZ - 2477219 - CVE-2026-42583 netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder
  • BZ - 2477220 - CVE-2026-42587 netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
  • BZ - 2477224 - CVE-2026-42584 netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
  • BZ - 2477226 - CVE-2026-42578 netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
  • BZ - 2477232 - CVE-2026-42581 netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
  • BZ - 2486697 - CVE-2026-40983 micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests
  • BZ - 2486716 - CVE-2026-40984 micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests
  • BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
  • BZ - 2488391 - CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake
  • BZ - 2488429 - CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
  • BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
  • BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
  • BZ - 2493407 - CVE-2026-57915 Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA
  • BZ - 2494841 - CVE-2026-50734 Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2511321 - CVE-2026-67589 org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation
  • BZ - 2511322 - CVE-2026-66273 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation
  • BZ - 2511324 - CVE-2026-67588 org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching
  • BZ - 2511326 - CVE-2026-66257 qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching
  • BZ - 2511327 - CVE-2026-67465 apache-qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching
  • BZ - 2511330 - CVE-2026-67551 Apache Qpid Proton-Dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation
  • BZ - 2511337 - CVE-2026-66274 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting
  • BZ - 2511346 - CVE-2026-67552 Apache Qpid Proton-Dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting
  • BZ - 2511355 - CVE-2026-67590 qpid-protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting
  • ENTMQCL-4560 - [protonj2] Inconsistent has result returned from Binary type
  • ENTMQCL-4561 - [protonj2] ROUND_ROBIN policy implementation error
  • ENTMQCL-4562 - [protonj2] Update proton-j test dependency to v0.35.0
  • ENTMQCL-4563 - [protonj2] Update netty to latest release 4.1.137.Final
  • ENTMQCL-4564 - [protonj2] Update junit to v5.14.4
  • ENTMQCL-4566 - [qpid-jms] JMSConsumer receiveBody should throw if message is a bare Message instance
  • ENTMQCL-4567 - [qpid-jms] Update to Netty 4.1.137.Final
  • ENTMQCL-4568 - [qpid-jms] Update jacoco plugin to 0.8.15
  • ENTMQCL-4569 - [qpid-jms] Update slf4j to version 2.0.18
  • ENTMQCL-4570 - [qpid-jms] Update mockito to v5.23.0
  • ENTMQCL-4571 - [qpid-jms] Update commons io to version 2.22.0
  • ENTMQCL-4572 - [qpid-jms] Update JUnit to version 5.14.4
  • ENTMQCL-4573 - [qpid-jms] Update ActiveMQ version in compatibility tests to 5.19.9
  • ENTMQCL-4574 - [qpid-jms] Update kerb-simplekdc test dep to 2.1.2
  • ENTMQCL-4575 - [qpid-jms] Update to proton-j 0.35.0
  • ENTMQCL-4576 - [qpid-jms] The combination of NMS DotNet AMQP producer and qpid-jms consumer doesn't handle the type of JMSReplyTo correctly.

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.