Red Hat Product Errata RHSA-2026:71675 - Security Advisory
Issued:
2026-09-24
Updated:
2026-09-24

RHSA-2026:71675 - Security Advisory

Synopsis

Important: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.

Type/Severity

Security Advisory: Important

Topic

Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.

The purpose of this text-only errata is to inform you about the security issues fixed.

Security Fix(es):

  • vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)
  • jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision (CVE-2026-10050)
  • rhaf-camel-spring-boot-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting (CVE-2026-66274)
  • jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections (CVE-2026-10051)
  • sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation (CVE-2026-56624)
  • cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage (CVE-2026-66909)
  • cxf-rt-rs-security-oauth2: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider (CVE-2026-68079)
  • cxf-rt-rs-security-oauth2: Apache CXF: Authorization Code Replay via Race Condition (CVE-2026-57818)
  • cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation (CVE-2026-57817)
  • camel: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (CVE-2026-46457)
  • camel: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (CVE-2026-46456)
  • camel: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields (CVE-2026-48203)
  • camel-amqp: Apache Camel: Information disclosure via deserialization of untrusted data (CVE-2026-42527)
  • proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation (CVE-2026-66273)
  • proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching (CVE-2026-66257)
  • netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder (CVE-2026-73507)
  • micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing (CVE-2026-59296)
  • cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters (CVE-2026-63687)
  • camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery (CVE-2026-63621)
  • camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component (CVE-2026-66908)
  • netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)
  • httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak (CVE-2026-64607)
  • jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
  • zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability (CVE-2026-87825)
  • zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service (CVE-2026-87877)
  • zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (CVE-2026-87824)
  • zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service (CVE-2026-87795)
  • zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)
  • jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
  • zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress (CVE-2026-90560)
  • bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
  • bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
  • zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing (CVE-2026-90852)
  • netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion (CVE-2026-59902)
  • camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior (CVE-2026-59230)
  • netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Integration - Camel for Spring Boot 1 x86_64

Fixes

  • BZ - 2497260 - CVE-2026-46457 camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
  • BZ - 2497261 - CVE-2026-48203 camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request ...
  • BZ - 2497282 - CVE-2026-46456 camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
  • BZ - 2497294 - CVE-2026-42527 camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of unt ...
  • BZ - 2499919 - CVE-2026-15075 vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects
  • BZ - 2499928 - CVE-2026-10051 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
  • BZ - 2503053 - CVE-2026-56624 org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
  • BZ - 2509736 - CVE-2026-64607 org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2511322 - CVE-2026-66273 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation
  • BZ - 2511326 - CVE-2026-66257 qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching
  • BZ - 2511337 - CVE-2026-66274 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting
  • BZ - 2511977 - CVE-2026-57817 org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation
  • BZ - 2511983 - CVE-2026-66909 org.apache.cxf/cxf: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage
  • BZ - 2511988 - CVE-2026-63687 cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters
  • BZ - 2511989 - CVE-2026-68079 org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider
  • BZ - 2511992 - CVE-2026-57818 org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition
  • BZ - 2515374 - CVE-2026-73507 io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder
  • BZ - 2520949 - CVE-2026-59296 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
  • BZ - 2521309 - CVE-2026-62243 io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
  • BZ - 2530661 - CVE-2026-87795 com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
  • BZ - 2530998 - CVE-2026-87824 com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
  • BZ - 2531003 - CVE-2026-87877 com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service
  • BZ - 2531007 - CVE-2026-87825 com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability
  • BZ - 2531577 - CVE-2026-89046 zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read
  • BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
  • BZ - 2532604 - CVE-2026-90560 com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress
  • BZ - 2533566 - CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.