Red Hat Product Errata RHSA-2026:70257 - Security Advisory
Issued:
2026-09-22
Updated:
2026-09-22

RHSA-2026:70257 - Security Advisory

Synopsis

Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)

Type/Severity

Security Advisory: Important

Topic

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of Important.

Description

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:

  • zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [rhboac-camel-quarkus-3] (CVE-2026-90852)
  • bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [rhboac-camel-quarkus-3] (CVE-2026-12860)
  • bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [rhboac-camel-quarkus-3] (CVE-2026-58059)
  • zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [rhboac-camel-quarkus-3] (CVE-2026-90560)
  • zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [rhboac-camel-quarkus-3] (CVE-2026-89046)
  • zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [rhboac-camel-quarkus-3] (CVE-2026-87824)
  • zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [rhboac-camel-quarkus-3] (CVE-2026-87795)
  • zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [rhboac-camel-quarkus-3] (CVE-2026-87877)
  • zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [rhboac-camel-quarkus-3] (CVE-2026-87825)
  • wire-runtime: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)
  • wire-runtime-jvm: Wire: Remote Denial of Service due to improper protobuf length validation [rhboac-camel-quarkus-3] (CVE-2026-45799)
  • bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [rhboac-camel-quarkus-3] (CVE-2026-59649)
  • wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [rhboac-camel-quarkus-3] (CVE-2026-19611)
  • hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [rhboac-camel-quarkus-3] (CVE-2026-77874)
  • netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY

streams [rhboac-camel-quarkus-3] (CVE-2026-93488)

  • netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec

HTTP/1.1 pipeline queue [rhboac-camel-quarkus-3] (CVE-2026-93491)

  • netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in

WebSocketServerExtensionHandler Leads to Denial of Service
[rhboac-camel-quarkus-3] (CVE-2026-93558)

  • netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf

reference-count leak (incomplete fix of PR #16881) [rhboac-camel-quarkus-3]
(CVE-2026-93564)

  • netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing

Control Byte [rhboac-camel-quarkus-3] (CVE-2026-93565)

  • netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed

HTTP/2 CONNECT with Host-controlled :authority [rhboac-camel-quarkus-3]
(CVE-2026-93567)

  • netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are

downgraded as regular CONNECT requests [rhboac-camel-quarkus-3] (CVE-2026-93568)

  • netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2

:authority, overriding the request-target authority [rhboac-camel-quarkus-3]
(CVE-2026-93569)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).

Affected Products

  • Red Hat Build of Apache Camel 1 x86_64

Fixes

  • BZ - 2510195 - CVE-2026-59649 org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
  • BZ - 2513748 - CVE-2026-77874 org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass
  • BZ - 2514568 - CVE-2026-19611 wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding
  • BZ - 2530661 - CVE-2026-87795 com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
  • BZ - 2530998 - CVE-2026-87824 com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
  • BZ - 2531003 - CVE-2026-87877 com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service
  • BZ - 2531007 - CVE-2026-87825 com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability
  • BZ - 2531577 - CVE-2026-89046 zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read
  • BZ - 2532604 - CVE-2026-90560 com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress
  • BZ - 2533566 - CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.