Read the docs
Red Hat Security Advisory

RHSA-2026:54622

Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.

Released 2026-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 25 records

TI-2026-40972 CVE-2026-56819 · GHSA-93wv-jw9v-4972

Uncontrolled resource consumption in netty

Priority HIGH 72

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2026-07-21 Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
TI-2026-06017 CVE-2026-6860 · GHSA-3g76-f9xq-8vp6

Improper certificate validation in Eclipse Vert.x

Priority HIGH 70

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00238 Published 2026-05-06 Partial fix · 4.5.27, 5.0.12 CWE-295
TI-2026-39301 CVE-2026-54428 · GHSA-v3jc-474w-2wm6

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Priority MEDIUM 40

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through mem…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00871 Published 2026-07-01 Partial fix · 5.4.3, 5.5-beta2 CWE-400
TI-2026-34351 CVE-2026-46726 · GHSA-hgg5-gp4c-gpcg

Improper input validation in Apache Camel Vertx Websocket

Priority MEDIUM 40

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00857 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-20
TI-2026-34252 CVE-2026-46592 · GHSA-mrrp-9gjm-749v

Improper input validation in Apache Camel

Priority MEDIUM 40

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00625 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-20
TI-2026-29516 CVE-2026-40859 · GHSA-6qw3-4796-5984

Deserialization of untrusted data in Apache Camel

Priority LOW 39

Deserialization of Untrusted Data vulnerability in Apache Camel.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00886 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +1 CWE-502
TI-2026-12691 CVE-2026-15076 · GHSA-vjx2-fp9g-q2mc

Origin validation error in Eclipse Vert.x

Priority LOW 35

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00197 Published 2026-07-14 Partial fix CWE-346
TI-2026-39275 CVE-2026-54399 · GHSA-hf6x-8p5f-cgmf

Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

Priority LOW 34

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memor…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00779 Published 2026-07-01 Partial fix · 5.4.3, 5.5-beta2 CWE-400
TI-2026-34245 CVE-2026-46584 · GHSA-29vj-9mgp-mwp2

Improper input validation in Apache Camel Mail

Priority LOW 18

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00562 Published 2026-07-06 Partial fix · 4.14.8, 4.18.3 +2 CWE-20