Red Hat Security AdvisoryRHSA-2026:70257
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
Released 2026-09-22 · Red Hat rating Important · View on Red Hat →
Fixes 21 records
Priority HIGH 77
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00619 · Published 2026-09-12 · Partial fix · 1.5.7-14 CWE-125
Priority HIGH 77
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.0065 · Published 2026-09-10 · Partial fix · 1.5.7-14 CWE-125
Priority HIGH 77
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00633 · Published 2026-09-09 · Partial fix · 1.5.7-14 CWE-125
Priority HIGH 72
A flaw was found in Netty's WebSocketServerExtensionHandler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01223 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority HIGH 72
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00728 · Published 2026-07-17 · Partial fix · 6.3.0, 7.0.0-alpha03 CWE-129
Priority HIGH 70
A vulnerability has been found in luben zstd-jni up to 1.5.7-13.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0054 · Published 2026-09-15 · Partial fix · 1.5.7-14 CWE-119
Priority HIGH 66
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes.
CVSS 4.0HIGH 7.0· Local · No auth · No interaction · EPSS 0.00221 · Published 2026-09-09 · Partial fix · 1.5.7-14 CWE-416
Priority MEDIUM 64
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced.
CVSS 4.0HIGH 7.0· Local · No auth · No interaction · EPSS 0.00214 · Published 2026-09-09 · Partial fix · 1.5.7-14 CWE-416
Priority MEDIUM 46
A flaw was found in Netty.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.02417 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-444
Priority MEDIUM 44
A flaw was found in Netty's HTTP/2 codec.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02885 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-20
Priority MEDIUM 44
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00389 · Published 2026-09-09 · Partial fix · 1.5.7-14 CWE-125
Priority MEDIUM 44
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 +3 CWE-789
Priority MEDIUM 44
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 +3 CWE-407
Priority MEDIUM 43
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00282 · Published 2026-09-24 · Partial fix CWE-89
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01077 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-20
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01059 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority MEDIUM 41
A flaw was found in Netty's HttpServerCodec.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00881 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-770
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00955 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-770
Priority MEDIUM 40
A flaw was found in Netty RtspDecoder.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00865 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority LOW 37
In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00171 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 CWE-347
Priority LOW 36
A flaw was found in WildFly Elytron.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01035 · Published 2026-08-20 · Partial fix · 2.8.4.Final-redhat-00002, 26.4.17-2 +4 CWE-173
THREATIST.IORead the docs