Red Hat Security Advisory

RHSA-2026:36839

Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP2)

Released 2026-07-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Build of Apache Camel 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.apache.cxf.cxf-core-4.1.7.rhbac-redhat-00003.jar

Fixes 5 records

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-36773 CVE-2026-49875 · GHSA-xw5h-cmh3-8j6j

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

MEDIUM 43

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2026-06-12 Partial fix · 4.2.2, 4.1.7 +1 CWE-611

TI-2026-39359 CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

MEDIUM 40

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01226 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-29635 CVE-2026-40984 · GHSA-g3pr-3p32-fp23

Micrometer HTTP server instrumentations DoS vulnerability

MEDIUM 40

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00792 Published 2026-06-09 Partial fix · 1.16.5.1, 1.15.11.1 +7 CWE-400

TI-2026-29634 CVE-2026-40983 · GHSA-w737-wx49-qj23

Micrometer gRPC server instrumentation DoS vulnerability

MEDIUM 40

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00631 Published 2026-06-09 Partial fix · 1.16.5.1, 1.15.11.1 +2 CWE-400