Red Hat Product Errata RHSA-2026:95622 - Security Advisory
Issued:
2026-11-05
Updated:
2026-11-05

RHSA-2026:95622 - Security Advisory

Synopsis

Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)

Type/Severity

Security Advisory: Important

Topic

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of Important.

Description

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:

  • vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb [rhboac-camel-quarkus-3] (CVE-2026-102477)
  • guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization [rhboac-camel-quarkus-3] (CVE-2026-102554)
  • vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure [rhboac-camel-quarkus-3] (CVE-2026-102460)
  • jetty-client: jetty-client: Information disclosure via improper proxy authentication handling [rhboac-camel-quarkus-3] (CVE-2026-77711)
  • snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression [rhboac-camel-quarkus-3] (CVE-2026-108106)
  • cxf-rt-ws-security: Apache CXF: Authentication bypass via hash collision in token cache [rhboac-camel-quarkus-3] (CVE-2026-97468)
  • cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state [rhboac-camel-quarkus-3] (CVE-2026-97791)
  • cxf-core: Apache CXF: Denial of Service via large multipart attachment headers [rhboac-camel-quarkus-3] (CVE-2026-107937)
  • cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing [rhboac-camel-quarkus-3] (CVE-2026-108039)
  • cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression [rhboac-camel-quarkus-3] (CVE-2026-78384)
  • snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress [rhboac-camel-quarkus-3] (CVE-2026-93452)
  • snappy-java: snappy-java: Denial of Service via out-of-bounds write [rhboac-camel-quarkus-3] (CVE-2026-90559)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).

Affected Products

  • Red Hat Build of Apache Camel 1 x86_64

Fixes

  • BZ - 2532603 - CVE-2026-90559 org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds write
  • BZ - 2538476 - CVE-2026-93452 org.xerial.snappy/snappy-java: snappy-java: Denial of Service due to buffer overflow in Snappy.compress
  • BZ - 2548455 - CVE-2026-97791 org.apache.cxf/cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state
  • BZ - 2548457 - CVE-2026-108039 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing
  • BZ - 2548458 - CVE-2026-78384 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression
  • BZ - 2548463 - CVE-2026-107937 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via large multipart attachment headers
  • BZ - 2548464 - CVE-2026-97468 org.apache.cxf/cxf-rt-ws-security: org.apache.cxf/cxf-services-sts-core: Apache CXF: Authentication bypass via hash collision in token cache
  • BZ - 2548629 - CVE-2026-108106 org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression
  • BZ - 2548685 - CVE-2026-102554 com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization
  • BZ - 2552802 - CVE-2026-102460 io.vertx/vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure
  • BZ - 2553096 - CVE-2026-102477 io.vertx/vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb
  • BZ - 2553119 - CVE-2026-77711 org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.