Red Hat Security AdvisoryRHSA-2026:63302
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
Released 2026-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
Fixes 10 records
Priority MEDIUM 47
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00331 · Published 2026-08-11 · Partial fix CWE-295
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 42
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00968 · Published 2026-08-31 · Partial fix · 3.27.5.SP1, 3.33.3.SP1 +2 CWE-1336
Priority MEDIUM 40
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix · 0.35.0 CWE-674
Priority MEDIUM 40
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix CWE-789
Priority MEDIUM 40
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00774 · Published 2026-08-05 · Partial fix CWE-770
Priority MEDIUM 40
A flaw was found in RESTEasy's SourceProvider.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0085 · Published 2026-08-31 · Partial fix · 6.2.16.Final-redhat-00003, 26.6.7-3 +6 CWE-611
Priority LOW 35
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization.
CVSS 4.0HIGH 8.2· Local · Low privileges · No interaction · EPSS 0.00145 · Published 2026-08-11 · Partial fix · 5.9.2 CWE-532
Priority LOW 33
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-08-17 · Partial fix · 4.1.137.Final, 4.2.17.Final CWE-524
Priority LOW 30
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response mes…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00464 · Published 2026-07-31 · Partial fix · 5.6.3 CWE-772
THREATIST.IORead the docs