Red Hat Product Errata RHSA-2026:83670 - Security Advisory
Issued:
2026-10-15
Updated:
2026-10-15

RHSA-2026:83670 - Security Advisory

Synopsis

Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)

Type/Severity

Security Advisory: Important

Topic

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.

Description

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:

  • jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [rhboac-camel-quarkus-3] (CVE-2026-89425)
  • jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [rhboac-camel-quarkus-3] (CVE-2026-91777)
  • bcpg-jdk18on: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation [rhboac-camel-quarkus-3] (CVE-2026-71887)
  • cxf-rt-wsdl: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [rhboac-camel-quarkus-3] (CVE-2026-65432)
  • camel-quarkus-support-xalan: Apache Camel Quarkus: Information disclosure via XML external entity injection [rhboac-camel-quarkus-3] (CVE-2026-88789)
  • wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion [rhboac-camel-quarkus-3] (CVE-2026-88920)
  • sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation [rhboac-camel-quarkus-3] (CVE-2026-93994)
  • sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies [rhboac-camel-quarkus-3] (CVE-2026-94002)
  • xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures [rhboac-camel-quarkus-3] (CVE-2026-102496)
  • xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing [rhboac-camel-quarkus-3] (CVE-2026-102495)
  • jackson-core: Jackson-core: Denial of Service via regular expression backtracking [rhboac-camel-quarkus-3] (CVE-2026-89407)
  • neethi: Neethi: Denial of Service via crafted WS-Policy documents [rhboac-camel-quarkus-3] (CVE-2026-91866)
  • neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [rhboac-camel-quarkus-3] (CVE-2026-91865)
  • neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing [rhboac-camel-quarkus-3] (CVE-2026-91863)
  • neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [rhboac-camel-quarkus-3] (CVE-2026-91864)
  • jetty-http: Jetty: HTTP request smuggling via crafted chunked requests [rhboac-camel-quarkus-3] (CVE-2026-19203)
  • quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service [rhboac-camel-quarkus-3] (CVE-2026-94449)
  • qute-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus [rhboac-camel-quarkus-3] (CVE-2026-93432)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [rhboac-camel-quarkus-3] (CVE-2026-89058)
  • mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs [rhboac-camel-quarkus-3] (CVE-2026-88033)
  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [rhboac-camel-quarkus-3] (CVE-2026-89059)
  • jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [rhboac-camel-quarkus-3] (CVE-2026-68497)
  • micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [rhboac-camel-quarkus-3] (CVE-2026-59296)
  • bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [rhboac-camel-quarkus-3] (CVE-2026-71889)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).

Affected Products

  • Red Hat Build of Apache Camel 1 x86_64

Fixes

  • BZ - 2511981 - CVE-2026-65432 Apache CXF: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing
  • BZ - 2519756 - CVE-2026-89059 resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)
  • BZ - 2519775 - CVE-2026-89058 resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config
  • BZ - 2520949 - CVE-2026-59296 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
  • BZ - 2529768 - CVE-2026-19203 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
  • BZ - 2531595 - CVE-2026-88033 org.mongodb/mongodb-driver-core: MongoDB Java Driver: Data disclosure and denial of service via query-operator injection in GridFS file IDs
  • BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
  • BZ - 2536859 - CVE-2026-93432 io.quarkus.qute:quarkus-core: Cross-Site Scripting (XSS) and JSON Injection via Qute {#eval} Section in Quarkus
  • BZ - 2537502 - CVE-2026-94449 quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service
  • BZ - 2538243 - CVE-2026-91866 Neethi: Neethi: Denial of Service via crafted WS-Policy documents
  • BZ - 2538446 - CVE-2026-91863 org.apache.neethi/neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing
  • BZ - 2538720 - CVE-2026-89407 com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking
  • BZ - 2538975 - CVE-2026-91865 org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents
  • BZ - 2539034 - CVE-2026-91864 org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents
  • BZ - 2539084 - CVE-2026-89425 com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing
  • BZ - 2539085 - CVE-2026-91777 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
  • BZ - 2543083 - CVE-2026-102495 org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing
  • BZ - 2543086 - CVE-2026-102496 org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures
  • BZ - 2543859 - CVE-2026-94002 org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies
  • BZ - 2543862 - CVE-2026-93994 org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation
  • BZ - 2543896 - CVE-2026-88920 org.apache.wss4j/wss4j-ws-security-dom: Apache WSS4J: Authentication bypass via unsigned SAML sender-vouches assertion

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.