Read the docs
Red Hat Security Advisory

RHSA-2026:48118

Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)

Released 2026-07-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 15 records

TI-2026-40972 CVE-2026-56819 · GHSA-93wv-jw9v-4972

Uncontrolled resource consumption in netty

Priority HIGH 72

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2026-07-21 Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
TI-2026-39301 CVE-2026-54428 · GHSA-v3jc-474w-2wm6

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Priority MEDIUM 40

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through mem…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00871 Published 2026-07-01 Partial fix · 5.4.3, 5.5-beta2 CWE-400
TI-2026-34351 CVE-2026-46726 · GHSA-hgg5-gp4c-gpcg

Improper input validation in Apache Camel Vertx Websocket

Priority MEDIUM 40

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00857 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-20
TI-2026-34252 CVE-2026-46592 · GHSA-mrrp-9gjm-749v

Improper input validation in Apache Camel

Priority MEDIUM 40

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00625 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-20
TI-2026-13631 CVE-2026-16308 · GHSA-g8rv-gp9f-q875

IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

Priority MEDIUM 40

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00549 Published 2026-07-30 Partial fix CWE-770
TI-2026-29516 CVE-2026-40859 · GHSA-6qw3-4796-5984

Deserialization of untrusted data in Apache Camel

Priority LOW 39

Deserialization of Untrusted Data vulnerability in Apache Camel.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00886 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-502
TI-2026-12691 CVE-2026-15076 · GHSA-vjx2-fp9g-q2mc

Origin validation error in Eclipse Vert.x

Priority LOW 35

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00197 Published 2026-07-14 Partial fix CWE-346
TI-2026-12690 CVE-2026-15075

Information disclosure in Eclipse Vert.x

Priority LOW 35

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00197 Published 2026-07-14 Partial fix CWE-200
TI-2026-39275 CVE-2026-54399 · GHSA-hf6x-8p5f-cgmf

Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

Priority LOW 34

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memor…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00779 Published 2026-07-01 Partial fix · 5.4.3, 5.5-beta2 CWE-400
TI-2026-34245 CVE-2026-46584 · GHSA-29vj-9mgp-mwp2

Improper input validation in Apache Camel Mail

Priority LOW 18

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00562 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +2 CWE-20