Read the docs
Red Hat Security Advisory

RHSA-2026:37390

Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.

Released 2026-07-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 32 records

TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3

Netty: HttpClientCodec response desynchronization

Priority HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444
TI-2026-37318 CVE-2026-50628 · GHSA-g5v7-jchf-7jrr

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Priority MEDIUM 50

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00735 Published 2026-06-12 Partial fix · 4.2.2, 4.1.7 +1 CWE-20
TI-2026-36773 CVE-2026-49875 · GHSA-xw5h-cmh3-8j6j

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Priority MEDIUM 43

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2026-06-12 Partial fix · 4.2.2, 4.1.7 +1 CWE-611
TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

Priority MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345
TI-2026-32796 CVE-2026-44930 · GHSA-pg32-686q-qh6x

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Priority MEDIUM 43

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00719 Published 2026-05-22 Partial fix · 4.2.1, 4.1.6 +1 CWE-90
TI-2026-34060 CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch

Netty: SCTP reassembly nests buffers without bound

Priority MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770
TI-2026-32225 CVE-2026-44248 · GHSA-jfg9-48mv-9qgx

Netty: Resource exhaustion in MqttDecoder

Priority MEDIUM 40

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400
TI-2026-29635 CVE-2026-40984 · GHSA-g3pr-3p32-fp23

Micrometer HTTP server instrumentations DoS vulnerability

Priority MEDIUM 40

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00792 Published 2026-06-09 Partial fix · 1.16.5.1, 1.15.11.1 +7 CWE-400
TI-2026-37323 CVE-2026-50633 · GHSA-qp3f-rvj8-46c8

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Priority LOW 39

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activa…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00925 Published 2026-06-12 Partial fix · 4.2.2, 4.1.7 +1 CWE-20
TI-2026-26738 CVE-2026-34480 · GHSA-3pxv-7cmr-fjr4

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Priority LOW 39

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01064 Published 2026-04-10 Partial fix · 2.25.4 CWE-116
TI-2026-37322 CVE-2026-50632 · GHSA-93g8-qqv3-mrx8

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Priority LOW 38

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00697 Published 2026-06-12 Partial fix · 4.2.2, 4.1.7 +1 CWE-20
TI-2026-26736 CVE-2026-34478 · GHSA-445c-vh5m-36rj

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Priority LOW 38

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00989 Published 2026-04-10 Partial fix · 2.25.4 CWE-117
TI-2026-32359 CVE-2026-44417 · GHSA-2hvc-5c6v-f533

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Priority LOW 36

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to con…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00663 Published 2026-05-22 Partial fix · 4.2.1, 4.1.6 +1 CWE-20
TI-2026-30866 CVE-2026-42586 · GHSA-rgrr-p7gp-5xj7

Netty: CRLF Injection in Netty Redis Codec Encoder

Priority LOW 31

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00217 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-93
TI-2026-26739 CVE-2026-34481 · GHSA-w35j-pv5h-q9q9

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Priority LOW 29

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-p…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00718 Published 2026-04-10 Partial fix · 2.25.4 CWE-116