RHSA-2026:17668CriticalCVSS 9.9

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.

Published
May 14, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (24)

CVE-2026-0636 →CVE-2026-2332 →CVE-2026-27446 →CVE-2026-35554 →CVE-2026-40858 →CVE-2026-40973 →CVE-2026-40975 →CVE-2026-40977 →CVE-2026-3505 →CVE-2026-33453 →CVE-2026-33870 →CVE-2026-40453 →CVE-2026-40860 →CVE-2026-41635 →CVE-2025-14813 →CVE-2025-67030 →CVE-2026-5795 →CVE-2026-6857 →CVE-2026-22731 →CVE-2026-33871 →CVE-2026-40022 →CVE-2026-40972 →CVE-2026-5588 →CVE-2026-33454 →

📋 Description

CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-5795 — org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables CVE-2026-6857 — camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization CVE-2026-22731 — Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path CVE-2026-27446 — org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication CVE-2026-33453 — Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection CVE-2026-33454 — Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection CVE-2026-33870 — io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values CVE-2026-33871 — netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood CVE-2026-35554 — Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management CVE-2026-40022 — camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers CVE-2026-40453 — Apache Camel: org.apache.camel: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection CVE-2026-40858 — org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data CVE-2026-40860 — Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage CVE-2026-40972 — Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison CVE-2026-40973 — Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory CVE-2026-40975 — Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. CVE-2026-40977 — Spring Boot: Spring Boot: Local file corruption via PID file manipulation CVE-2026-41635 — Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass

🎯 Affected products1

  • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application's configuration to prevent this overlap. A redeployment of the application is required for changes to take effect. Workaround: To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default "artemis" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the "protocols" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect. Workaround: This flaw may be mitigated by temporarily disabling routes that allows arbitrary writes and executions (camel-exec and camel-file) Workaround: To mitigate this issue, disable the Spring Boot DevTools remote functionality in production environments. This feature is primarily intended for development and should not be enabled in publicly accessible deployments. To disable remote DevTools, ensure the `spring.devtools.remote.secret` property is not configured, or explicitly set `spring.devtools.remote.enabled=false` in your application's `application.properties` or `application.yml` file. Example for `application.properties`: `spring.devtools.remote.enabled=false` Disabling this feature may impact development workflows that rely on remote DevTools capabilities. A restart of the application is required for the changes to take effect. Workaround: To mitigate this issue, ensure that the `server.servlet.session.persistent` property is set to `false` in your Spring Boot application's configuration. This prevents session information from being written to the predictable temporary directory, thereby removing the conditions necessary for exploitation. Disabling persistent sessions may affect application behavior that relies on session data surviving restarts. Workaround: Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used.

🔗 References (26)