Read the docs
Red Hat Security Advisory

RHSA-2026:22453

Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA)

Released 2026-06-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2026-01972 CVE-2026-2332 · GHSA-355h-qmc2-wpwf

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Priority HIGH 74

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01305 Published 2026-04-14 Partial fix · 12.1.7, 12.0.33 +3 CWE-444
TI-2026-29517 CVE-2026-40860 · GHSA-m5vh-3fw5-5wgh

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

Priority MEDIUM 52

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01739 Published 2026-04-27 Partial fix · 4.14.7, 4.18.2 +1 CWE-502
TI-2026-29515 CVE-2026-40858 · GHSA-4xwx-hvv7-7prj

Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

Priority MEDIUM 43

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01305 Published 2026-04-27 Partial fix · 4.14.7, 4.18.2 +1 CWE-502