Red Hat Security Advisory

RHSA-2026:54776

Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)

Released 2026-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Fixes 7 records

TI-2026-48269 CVE-2026-68494 · GHSA-r7wm-3cxj-wff9

Resource allocation without limits in FasterXML jackson-core

HIGH 77

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00463 Published 2026-08-04 Partial fix · 2.18.8, 2.21.4 +1 CWE-770

TI-2026-40028 CVE-2026-55471 · GHSA-2f55-g35j-5jmf

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HIGH 77

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00569 Published 2026-07-08 Partial fix · 6.9.10 CWE-611

TI-2026-44485 CVE-2026-62296

HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-07 Partial fix · 6.9.11 CWE-20

TI-2026-40027 CVE-2026-55470 · GHSA-fxj4-p9xp-37v5

HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HIGH 72

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0068 Published 2026-07-08 Partial fix · 6.9.10 CWE-1333

TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…

MEDIUM 46

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-409

TI-2026-32947 CVE-2026-45112 · GHSA-g9fj-fh28-776p

Apache Thrift: Unbounded Read Leading to Denial of Service

LOW 38

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-770

TI-2026-40830 CVE-2026-56624 · GHSA-j262-jh5j-p4fw

Apache MINA SSHD: SSH certificate options lack validations

LOW 34

Improper certificate validation in Apache MINA SSHD (server-side).

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.0029 Published 2026-07-20 Partial fix CWE-295